Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - AutoWhitelist problems
  FAQ FAQ  Forum Search   Register Register  Login Login

AutoWhitelist problems

 Post Reply Post Reply
Author
clator View Drop Down
Newbie
Newbie


Joined: 22 February 2007
Location: United States
Status: Offline
Points: 4
Post Options Post Options   Thanks (0) Thanks(0)   Quote clator Quote  Post ReplyReply Direct Link To This Post Topic: AutoWhitelist problems
    Posted: 22 February 2007 at 5:21pm
I've noticed a ton of spam getting in lately, mostly of two varieties.  Either with the VAR114/VAR115 subject, or with a subject of some random Biblical-esque saying.  They almost always have pharmaceutical content inside on a big image.

I was curious as to how they were getting in, and looked in my SpamFilter logs to find the most recent one.  Apparently it was AutoWhiteListed, but I cannot figure out why.  The header itself contains the phrase "X-SF-WhiteListedReason: AutoWhiteList Force Delivery" ... could that be it?

Can I send somebody the details in email so they do not get posted publicly?


Edited by clator
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4065
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 22 February 2007 at 5:33pm
Yeap... that's the main reason. The emails are being whitelisted due to an entry in your AutoWhiteListForceDelivery.txt file.
When you force-deliver an email that was in the quarantine, the sender is automatically matched with the recipient. From then on, all emails from that sender to that recipient are automatically whitelisted. The entry:

from@sender.com|to@recipient.com

will be added to your AutoWhiteListForceDelivery.txt file. Looking at the email yo ujust received, look at the address specified in the "X-SF-RX-Return-Path" or the "Return-Path" headers. That's you sender, and most likely you'll find them in the AutoWhiteListForceDelivery file. If so, simply delete that line from the file, no need to stop/restart SpamFilter...
Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
clator View Drop Down
Newbie
Newbie


Joined: 22 February 2007
Location: United States
Status: Offline
Points: 4
Post Options Post Options   Thanks (0) Thanks(0)   Quote clator Quote  Post ReplyReply Direct Link To This Post Posted: 22 February 2007 at 7:17pm
Excellent.  I never understood that file before your explanation.  I've edited it and restarted.  Hopefully this will help.
Back to Top
Radu View Drop Down
Newbie
Newbie


Joined: 03 April 2007
Status: Offline
Points: 1
Post Options Post Options   Thanks (0) Thanks(0)   Quote Radu Quote  Post ReplyReply Direct Link To This Post Posted: 03 April 2007 at 5:13am

Does it mean that all spammers who include "X-SF-WhiteListedReason: keyword whitelist match" can bypass the spam filter?

 

Back to Top
lyndonje View Drop Down
Senior Member
Senior Member
Avatar

Joined: 31 January 2006
Location: United Kingdom
Status: Offline
Points: 192
Post Options Post Options   Thanks (0) Thanks(0)   Quote lyndonje Quote  Post ReplyReply Direct Link To This Post Posted: 03 April 2007 at 7:58am
Hi Radu,

No that is not the case.

That is the header added by SF when a keyword whitelist match is detected.

This header is NOT checked by SF to determine whether or not an email should be classed as spam.

Regards
Lyndon.
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.090 seconds.