Print Page | Close Window

A Mojor SPAM Pounding!

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=448
Printed Date: 23 October 2017 at 11:15am


Topic: A Mojor SPAM Pounding!
Posted By: Sean
Subject: A Mojor SPAM Pounding!
Date Posted: 09 May 2003 at 12:13pm

Ok on the first day we ran SpamFilter ISP it blocked only about 1000 emails overnight. Second night, 5000, now last night 10000+! I honestly don't believe we are recieving this much email, and these are Duplicates, or retries.

Is this a result of the senders mail server trying additional attempts to deliver the email message even though it recieved the "Denied" Error message from SpamFilter?

If so, how can I prevent this, becuase now it seems this will increase bandwidth usage tremendously just to check the headers then MAPS servers, then deny the message and disconnect, for messages that have already been processed.

NOTE: Only filter being use is MAPS filter, for original 5 included in version 1.1.2.117

Running Version 1.1.2.117

 




Replies:
Posted By: LogSat
Date Posted: 09 May 2003 at 12:23pm

Sean,

In our experience spammers will retry sending if they are disconnected, so that will increase traffic, but not ten-fold!

We have found a problem if selecting the "reject if empty mail from" option. Since non-deliverable error notifications and email receipts are sent with null "mail froms", they are being rejected. We will be removing that feature in the next build. Please try unchecking that option in the meantime.

Another thing yo can take a look at is the "Error Handler Email" config under Settings - Customizeed Items. Try entering there something like:

"System Administrator" <>

with a null email address to avoid loops in case the error emails are themselves returned.

If you still have problems, you could email us a copy of your spamfilter logs for the day you received 1,000 emails and one for the 10,000 day, so we can find any correlation between the two to find out why the increase.

Roberto Franceschetti
LogSat Software



Posted By: Sean
Date Posted: 09 May 2003 at 12:30pm

I had already turn off the reject if FROM is empty option, after reading previous Forum post, as well as noticing our Deliever Reciepts and Read Reciepts were being quarentined.

So now I null the email for the Postmaster reply. But for contact pruposes can the name in this be of any length? Such as "Undeliveable Assitant at Company, Please call if you believe this to be an error <>"? Just incase somepeople have no clue what MAP blacklist do?

 



Posted By: Sean
Date Posted: 09 May 2003 at 12:34pm
Also, You were right to say most were replies to undiliverable Repies to the blocked sender. Hopefully now this will decrease when the null email is sent back in the loop.


Posted By: bpogue99
Date Posted: 14 May 2003 at 4:45pm
Are you totally removing the "reject on empty from"? option? Rather than remove it, why not provide an option to disable reject notices? I dont want any emails with an empty from getting past.


Posted By: LogSat
Date Posted: 15 May 2003 at 12:40pm

Even though it does not meet the RFC requirements, we'll most likely leave the "reject on empty from" option in future builds.

Roberto
LogSat Software




Print Page | Close Window