Print Page | Close Window

Keywords Filter

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
Printed Date: 22 February 2019 at 2:07am

Topic: Keywords Filter
Posted By: flessendop
Subject: Keywords Filter
Date Posted: 25 June 2014 at 8:14am

I got a problem with my keyword filter.

Here are some words in it:

ruby palace
Trading Wall
The most undervalued company this year
Eat This, Not That
TD Ameritrade
The Team
Update your profile
Financial News
Our New Stock Alert!

Most of emails with this in the content isn't be blocked 

How can i change this so we don't get the spam ?

Version ( REGISTERED )

With regards,


Posted By: LogSat
Date Posted: 25 June 2014 at 9:10pm

Could you please zip us the following so we can take a look:

• Two or three emails with the content that you think should have triggered a match with one of your keywords

• SpamFilter's activity logfile for the day the above emails were received

• Your SpamFilter.ini file

• The \SpamFilter\Domains directory structure (if the files containing any of your blacklists/whitelists are outside that directory tree, please include those as well.

If the zip is smaller than 8MB, you can email it to us at support at If the zipped file is over 8MB in size, I'll send you via PM a URL where you can upload the files to us.


Please ensure you send us the original emails, with their headers and body unaltered, as we'll need to see the source of the emails to determine what happened. Usually forwarding the emails as attachments rather than inline suffices. 

Roberto Franceschetti" rel="nofollow - LogSat Software" rel="nofollow - Spam Filter ISP

Posted By: flessendop
Date Posted: 26 June 2014 at 3:43am
I send an e-mail to u.

Posted By: LogSat
Date Posted: 26 June 2014 at 7:42am

We received your files. Missing from both same emails are all the headers added by SpamFilter, which indicate that the email was never processed by SpamFilter to begin with. These are the SpamFilter headers (which usually start with an X-SF- prefix) to look for:


The emails processed by SpamFilter will also have a "Received" header similar to this:

Received: from 212.54.nnn.nnn by (SpamFilter ISP); Thu, 26 Jun 2014 02:54:55 -0400

Checking the MX record for your domain, I see that you have 4 entries in there with different priorities. SpamFilter is installed on the server with priority 10:  86400  IN  MX  10

However there are also entries with priorities 15, 20 and 25. On the servers with priorities 15 and 20 you don't have SpamFilter running, but rather have a "Microsoft ESMTP MAIL Service" listening for SMTP traffic. Please note that spammers will often ignore the RFC and send their spam emails directly to secondary MX records, knowing that they are often not as protected as the primary MX records.

You can verify this is exactly what happened in your case by looking at this Received header for one of your email samples:

Received: from ( by ( with Microsoft SMTP Server id;

 Thu, 26 Jun 2014 08:51:27 +0200

I've altered the host name to protect your privacy, but if you look at the original email you will see that is the secondary MX server with priority 20 in your DNS (which is not protected by SpamFilter).

To resolve this you would either need to install SpamFilter on all your secondary MX servers (please note that a new license is required for each of them), or install another anti spam solution, or remove the secondary MX records from the DNS.

Roberto Franceschetti" rel="nofollow - LogSat Software" rel="nofollow - Spam Filter ISP

Posted By: flessendop
Date Posted: 26 June 2014 at 9:36am
So when i delete MX15 and MX20 the problem must be solved  ?

Posted By: LogSat
Date Posted: 26 June 2014 at 5:04pm
Yes, as far as spammers bypassing your SpamFilter server and sending emails to the secondaries, that would definitely put a stop to it.

Roberto Franceschetti" rel="nofollow - LogSat Software" rel="nofollow - Spam Filter ISP

Print Page | Close Window