Spam Filter ISP Forums

Spam Filter ISP Forums http://www.logsat.com/spamfilter/forums/ This is an XML content feed of; Spam Filter ISP Forums : Last 10 Posts Wed, 07 Jan 2009 04:49:10 +0000 Wed, 07 Jan 2009 03:58:20 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 9.06 30 www.logsat.com/spamfilter/forums/RSS_topic_feed.asp Spam Filter ISP Support : Valid mail blocked by URL Scan http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6595&PID=12554#12554 Author: sirrar
Subject: Valid mail blocked by URL Scan
Posted: 07 January 2009 at 3:58am

Hi.

When sending a mail with a link in it (signature) It says that its blacklisted by zen.spamhaus.org. When i do a manually check at www.spamhaus.org it states that this ip is not listed in any block list

Doesn't the query look wrong? The ip is typed backwards???

X-Rejection-Reason: 27 - URL in the email resolved to a blacklisted IP : (www.com-it.dk) - 521 The IP 80.63.58.114 is Blacklisted by zen.spamhaus.org. http://www.spamhaus.org/query/bl?ip=114.58.63.80 -- 521 The IP 80.63.58.114 is Blacklisted by pbl.spamhaus.org. http://www.spamhaus.org/query/bl?ip=114.58.63.80 --

Please don't get confused when doing the wrong query (the query spamfilter performs) cause I have removed the wrong ip from the list (should'nt have done that) I thought at first that it was spamhaus which was wrong.

When i do a manually query at spamhaus it looks like this

http://www.spamhaus.org/query/bl?ip=80.63.58.114

Running 4.1.2.796 Licensed

Edited by sirrar - Today at 4:13am]]> Wed, 07 Jan 2009 03:58:20 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6595&PID=12554#12554 Spam Filter ISP Support : AutoWhiteList Force Delivery error http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6593&PID=12553#12553 Author: Ed_K
Subject: AutoWhiteList Force Delivery error
Posted: 06 January 2009 at 8:40pm

Hello,

We're encountering a very similar issue at one of my clients who uses SpamFilter ISP. Our OS and build are identical to the OP's except we are using Standard as opposed to Enterprise.

In this instance, the offending spam is spoofing the recipient's email address. This client's DNS provider does not allow SPF or TXT records in their DNS (I've strongly recommended that they change providers) so instead I've enabled the 'Reject if "Mail From" = "Mail To"' option under Filter Settings.

I expected that to fix it, so when it didn't, I started looking at the headers. Here is an excerpt:

X-SF-WhiteListedReason: AutoWhiteList Force Delivery
X-Rejection-Reason: 8 - 557 client's custom SPAM message

I'm not sure exactly what AutoWhiteList is, but I don't see any rule in any of our White List settings that should be allowing this mail. I found that we were not logging, so I have just turned it on and will restart the service after production hours. I'll gladly forward the logs I gather to support unless a resolution is proposed in the meantime. Thanks a lot! -Ed

Edited by Ed_K - Yesterday at 8:41pm]]> Tue, 06 Jan 2009 20:40:10 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6593&PID=12553#12553 Spam Filter ISP Support : AutoWhiteList Force Delivery error http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6593&PID=12552#12552 Author: LogSat
Subject: AutoWhiteList Force Delivery error
Posted: 06 January 2009 at 5:43pm

rudaf,

Did the domain "forgeddomain" actually implement SPF in their DNS? Please do note that SPF will be able to block forged spam only if the domain does have valid SPF records in their DNS.

If that's affirmative, could you please zip and email us at support at logsat.com SpamFilter's activity logfile for a day this happened, along with the to/from email addresses involved?

if the zip is over 5MB in size, I'll provide you with our FTP login info via a PM.]]> Tue, 06 Jan 2009 17:43:25 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6593&PID=12552#12552 Spam Filter ISP Support : Using new filter resolving IP http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6594&PID=12551#12551 Author: Desperado
Subject: Using new filter resolving IP
Posted: 06 January 2009 at 4:24pm

Shade,

All you need to do is enable it. In the GUI, if you click on "Filter Settings" you will see a check box under Options. The rest is done by SpamFilter using the "MAPS Servers" specified under the Black Lists group.

]]> Tue, 06 Jan 2009 16:24:24 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6594&PID=12551#12551 Spam Filter ISP Support : Using new filter resolving IP http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6594&PID=12550#12550 Author: Shade
Subject: Using new filter resolving IP
Posted: 06 January 2009 at 11:05am

Dear All,

First of all, I wish a happy new year to all spamfilters's team and freaks Smile

Second, I have just upgraded to new version 4.1.2.796.
There is a new filter "created new filter that resolves to IPs all URLs embedded in emails,and then performs a lookup of those IPs in the MAPS RBL blacklists".
I'm using an entreprise edition, with MySQL database for domains.

How can I use this new filter ?

Thank you for reply !
Best regards,
Shade.
]]> Tue, 06 Jan 2009 11:05:07 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6594&PID=12550#12550 Web Interface Mods : New WebUI supports MySQL & SQL and Std an http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6112&PID=12549#12549 Author: Karsten
Subject: New WebUI supports MySQL & SQL and Std an
Posted: 06 January 2009 at 1:03am

Hi

Can you help me get it to work, I can install it and set the admin pw, but when I try to login to the site I get this error :

Cannot open the database specified by the installation. Please reinstall the Spam Filter Manager. UDL path = c:\inetpub\wwwroot\Spamweb\DbConn.udl

but if I run the DbConn.udl and test the connection there is no problem ?

Regards

Karsten

]]> Tue, 06 Jan 2009 01:03:40 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6112&PID=12549#12549 Spam Filter ISP Support : AutoWhiteList Force Delivery error http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6593&PID=12548#12548 Author: rudaf
Subject: AutoWhiteList Force Delivery error
Posted: 05 January 2009 at 6:43pm

SFE 4.0.1.785

SQL SERVER 2000 STD

OS WIN 2KSVR SP4

We are subjected to domain forgery spam. months ago we successfully implemented SPF rules.

Now a lot of forged domains and accounts spam is passing SFE (eg. forgedaccount@forgeddomain to forgedaccount@forgeddomain) even if the SPF filter is enabled.

The log reported AutoWhiteList Force Delivery since in the autowhite list there was the rule *@MYDOMAIN | *@MYDOMAIN

Although useful to avoid intra domain false positive, we removed such a rule throuh SFE configuration control panel, but forged mails keep to pass the filters (AutoWhiteList Force Delivery), even if the log reports SPF Fail and mail destinated to be quatantined.

Any idea?

]]> Mon, 05 Jan 2009 18:43:06 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6593&PID=12548#12548 Spam Filter ISP Support : Table 'tblquarantine' details http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6574&PID=12547#12547 Author: LogSat
Subject: Table 'tblquarantine' details
Posted: 30 December 2008 at 8:03am

If the "expire" field is set to "1", this marks the message to be deleted the next time SpamFilter performs a database purge. The "purge" removes from the database all messages that are older than your retention period (the "number of days to store quarantine rejected emails" value in the database configuration tab in SpamFilter). The database purge occurs by default every 60 minutes.]]> Tue, 30 Dec 2008 08:03:53 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6574&PID=12547#12547 Spam Filter ISP Support : Table 'tblquarantine' details http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6574&PID=12546#12546 Author: suchi
Subject: Table 'tblquarantine' details
Posted: 30 December 2008 at 12:19am

ok.that is understood by me.

But what is the exact status of msg if 'deliver' field is set to '0' and 'expire' set to '1'...

I am bit confused about this.

Thanks in advance.

]]> Tue, 30 Dec 2008 00:19:29 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6574&PID=12546#12546 Spam Filter ISP Support : iPhones and SMTP auth http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6190&PID=12545#12545 Author: LogSat
Subject: iPhones and SMTP auth
Posted: 24 December 2008 at 3:20pm

Correct.]]> Wed, 24 Dec 2008 15:20:38 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6190&PID=12545#12545