Spam Filter ISP Forums http://www.logsat.com/spamfilter/forums/ This is an XML content feed of; Spam Filter ISP Forums : Last 10 Posts Sat, 13 Mar 2010 19:34:31 +0000 Fri, 12 Mar 2010 22:15:57 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 9.61 30 www.logsat.com/spamfilter/forums/RSS_topic_feed.asp Spam Filter ISP Support : Is spamfilter using barracudacentral.org? http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6810&PID=13489#13489 Author: LogSat
Subject: Is spamfilter using barracudacentral.org?
Posted: 12 March 2010 at 10:15pm

Morten,

Without seeing your customer's email it's not possible to determine what is happening. If that IP is not the one for your own server, then Barracuda is possibly looking inside the email sent by your user, and looking up the URLs it contains in the email's hyperlink against their own blacklists. If it's a false positive (meaning the email is not spam), then this would just be an example of an email incorrectly blocked by Barracuda. Even SpamFilter will occasionally incorrectly block valid emails by thinking they're spam, so we can't fault Barracuda for doing the same Smile.
]]> Fri, 12 Mar 2010 22:15:57 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6810&PID=13489#13489 Spam Filter ISP Support : DNS Error: Timedout http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6808&PID=13488#13488 Author: LogSat
Subject: DNS Error: Timedout
Posted: 12 March 2010 at 10:06pm

SpamFilter will always use the DNS servers specified in its configuration for its queries. The DNS server being queried will then take care of contacting the proper DNS server(s) responsible for the lookup and will provide the reply to SpamFilter (unless your DNS server already has the response in its cache).]]> Fri, 12 Mar 2010 22:06:39 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6808&PID=13488#13488 Spam Filter ISP Support : Is spamfilter using barracudacentral.org? http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6810&PID=13487#13487 Author: morten44
Subject: Is spamfilter using barracudacentral.org?
Posted: 12 March 2010 at 5:25pm

Hi
We have some customer using our mail server who starts to get their mails rejected because they are blocked by http://www.barracudacentral.org/
 
I have checked our spamfilter and I can not see that we are asking all mails to be checked by them so I cant understand that our mail server is causing this
 
The customer get a message:
> Body of message generated response:
> 554 Service unavailable; Client host [ip0x1a1e89.bip.mvb.dk] blocked using Barracuda Reputation; http://bbl.barracudacentral.com/q.cgi?ip=80.198.234.178 <http://bbl.barracudacentral.com/q.cgi?ip=80.198.234.178>

This is not the IP of our mail server but the IP of the person sending the mail.
Can you out from this see if this is something that our ISP Spamfilter is blocking?

I have read alot about barracudacentra.com and it seems to be spam in itself.

My Questions are:
Can it be our Spamfilter that rejects the mails because its blacklisted in Barracudacentral?

If not is the barracudacentra.com just spam in itself?

 
Kind Regards
Morten
]]> Fri, 12 Mar 2010 17:25:40 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6810&PID=13487#13487 Spam Filter ISP Support : V3.1.3.615 on Linux/MySQL "update tblquarantine.." http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6806&PID=13486#13486 Author: Markus
Subject: V3.1.3.615 on Linux/MySQL "update tblquarantine.."
Posted: 12 March 2010 at 10:13am

Hi Roberto
Many thanks for your fast reply. So - if there is no workaround I have to install the new version.
]]> Fri, 12 Mar 2010 10:13:40 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6806&PID=13486#13486 Spam Filter ISP Support : Embarrassed by new client http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6725&PID=13485#13485 Author: yapadu
Subject: Embarrassed by new client
Posted: 11 March 2010 at 11:40pm

I see GFI now has a tester as well (not sure how long they have had it).  They send a bunch of tests, a lot of which are tests against the email client.

But they do send 5 copies of eicar test virus.  Spamfilter fails on all of them Cry
]]> Thu, 11 Mar 2010 23:40:29 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6725&PID=13485#13485 Spam Filter ISP Support : Embarrassed by new client http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6725&PID=13484#13484 Author: yapadu
Subject: Embarrassed by new client
Posted: 11 March 2010 at 8:24pm

Was the issue of these messages getting past spamfilter ever resolved?  I continue to see new clients testing our system and the virus messages still go through from the looks of it.]]> Thu, 11 Mar 2010 20:24:50 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6725&PID=13484#13484 Spam Filter ISP Support : DNS Error: Timedout http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6808&PID=13483#13483 Author: yapadu
Subject: DNS Error: Timedout
Posted: 11 March 2010 at 8:19pm

When spamfilter is checking a blacklist (like spamcop or something) it still processes the request through our local DNS server correct?  Or does spamfilter go direct to the blacklist provider?

I attempted to run an instance on Amazon Cloud, and found requests to many of the 3rd party blacklists were rejected automatically from the Amazon Cloud address space.
]]> Thu, 11 Mar 2010 20:19:33 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6808&PID=13483#13483 Spam Filter ISP Support : Random Permanent Failures http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6809&PID=13482#13482 Author: LogSat
Subject: Random Permanent Failures
Posted: 11 March 2010 at 4:35pm

That should indeed not happen - it indicates a serious error within SpamFilter. Can you please zip and email us SpamFilter's activity logfiles for the day this happened and for the day prior to that so we can see what is happening? If the zip is over 8MB in size, please upload it to us via FTP. I'll send you the ftp login info via a PM.]]> Thu, 11 Mar 2010 16:35:53 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6809&PID=13482#13482 Spam Filter ISP Support : DNS Error: Timedout http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6808&PID=13481#13481 Author: LogSat
Subject: DNS Error: Timedout
Posted: 11 March 2010 at 4:33pm

...you know what, I had never thought about that either! We're evenSmile]]> Thu, 11 Mar 2010 16:33:39 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6808&PID=13481#13481 Spam Filter ISP Support : Random Permanent Failures http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6809&PID=13480#13480 Author: dotme
Subject: Random Permanent Failures
Posted: 11 March 2010 at 9:39am

We're having an issue with SpamFilter terminating incoming mail with prejudice.
 
The error the sender receives is Remote host said: 557 The server encountered an error while processing this message. Please retry later.
 
That "557" is fatal - sending servers do not retry. And we end up looking like chumps.
 
Can anyone shed light on why an internal processing error would generate a permanent failure code instead of a temporary "4xx" error so emails could be re-queued by the sending system?
 
This issue is pretty random. I'll see it in a logfile along with hundreds of successful deliveries. Here's the SpamFilter excerpt of the event that triggers that 557 error...
 
03/11/10 05:16:54:265 -- (644) Connection from: x.x.x.x  -  Originating country : United States
03/11/10 05:16:55:171 -- (644) Received MAIL FROM: <sender@senderdomain.com>
03/11/10 05:16:55:249 -- (644) Received RCPT TO: recipient@example.com
03/11/10 05:16:55:265 -- (644) Resolving x.x.x.x - mail.senderdomain.com
03/11/10 05:17:02:515 -- (644) - SPF analysis for senderdomain.com done: - none
03/11/10 05:17:02:515 -- (644) Mail from: sender@senderdomain.com
03/11/10 05:17:23:515 -- (644) - MAPS search done...
03/11/10 05:17:23:515 -- (644) RCPT TO: recipient@example.com accepted
03/11/10 05:17:23:874 -- (644) Checking SFDC
03/11/10 05:17:24:218 -- (644) SFDC - Added x.x.x.x - Response: Error=0
03/11/10 05:17:24:234 -- (644) Exception occurred during RECEIVEMESSAGE: ( 1 2 2b 3 3a 4 5 6 7 8 9 11 12 13 15 16 17 18 18b 19 20b 20c 29 30 31 32 111) Access violation at address 00413B4E in module 'SpamFilterSvc.exe'. Read of address 00000005 --
03/11/10 05:17:24:312 -- (644) Disconnect
 
If we restart the service, things are smooth again for a few days. But this random rejection business is difficult to explain to customers. Any help greatly appreciated.
]]> Thu, 11 Mar 2010 09:39:47 +0000 http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6809&PID=13480#13480