Print Page | Close Window

Mail from / Envelope-From

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: http://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5953
Printed Date: 22 October 2017 at 12:53am


Topic: Mail from / Envelope-From
Posted By: craigeb78
Subject: Mail from / Envelope-From
Date Posted: 19 January 2007 at 2:13pm

I have added an entry to my mail-from Blacklist, and noticed emails still getting through.   While researching, it looks like SF recognized the envelope-from field as the mail from field, and allowed the message because the address is different.    Which should I be blocking?   I would think that I should block the mail from, since that's what most users will report to me.  I've posted the headers and the log below to show you what I mean:

Logs:

Quote

01/19/07 08:40:24:179 -- (42508) Connection from: 66.216.179.115  -  Originating country : United States
01/19/07 08:40:24:820 -- (42508) found SPF record for b.lt05.net: v=spf1 include:listrak.com ?all
01/19/07 08:40:24:882 -- (42508) found SPF record for listrak.com: v=spf1 ptr ?all
01/19/07 08:40:24:960 -- (42508) SPF query result: pass
01/19/07 08:40:24:960 -- (42508) - SPF analysis for listrak.com done: - pass
01/19/07 08:40:24:976 -- (42508) SPF query result: pass
01/19/07 08:40:24:976 -- (42508) - SPF analysis for b.lt05.net done: - pass
01/19/07 08:40:24:992 -- (42508) Mail from: mailto:50A55D31FE60625652A400B74796A4E962299675CD81A870C3DFAC30D409730A@b.lt05.net - 50A55D31FE60625652A400B74796A4E962299675CD81A870C3DFAC30D409 730A@b.lt05.net
01/19/07 08:40:25:460 -- (42508) - MAPS search done...
01/19/07 08:40:25:460 -- (42508) RCPT TO: me@me.com  accepted
01/19/07 08:40:25:679 -- (42508) EMail from mailto:50A55D31FE60625652A400B74796A4E962299675CD81A870C3DFAC30D409730A@b.lt05.net - 50A55D31FE60625652A400B74796A4E962299675CD81A870C3DFAC30D409 730A@b.lt05.net to  mailto:me@me.com - me@me.com   passes Bayesian filter - 0% spam  (31ms)
01/19/07 08:40:25:804 -- (42508) EMail from mailto:50A55D31FE60625652A400B74796A4E962299675CD81A870C3DFAC30D409730A@b.lt05.net - 50A55D31FE60625652A400B74796A4E962299675CD81A870C3DFAC30D409 730A@b.lt05.net to mailto:me@me.com - me@me.com  was queued. Size: 7 KB, 7168 bytes
01/19/07 08:40:25:929 -- (42508) Disconnect

Headers:

Quote

Received: from 66.216.179.115 by yis10.yorkinternet.net (LogSat Software SMTP Server - Unlicensed Evaluation Copy); Fri, 19 Jan 2007 08:40:25 -0500
Received: by vmta-b-115.listrak.com id hm35e8067nct for < mailto:me@me.com - me@me.com >; Fri, 19 Jan 2007 08:42:29 -0500 (envelope-from < mailto:50A55D31FE60625652A400B74796A4E962299675CD81A870C3DFAC30D409730A@b.lt05.net - 50A55D31FE60625652A400B74796A4E962299675CD81A870C3DFAC30D409 730A@b.lt05.net >)
From: "Wireless Xcessories Group" < mailto:sales@wirexgroup.com - sales@wirexgroup.com >
To: " mailto:me@me.com - me@me.com " < mailto:me@me.com - me@me.com >
Reply-To: mailto:sales@wirexgroup.com - sales@wirexgroup.com
Subject: Plantronics Valentines day promo-free carry case w/ 640e/655 purchase




Replies:
Posted By: caratking
Date Posted: 19 January 2007 at 7:54pm
I noticed the same thing the other day - but the emails were from myself.

I had a PHP script that was emailing me some info, and it was being blocked because of an invalid MX record.

The sender in the from field was support@mydomain.com, but SF was blocking the email as it was using the sender it found in the headers as apachie@s90.mydomain.com which of course does not have a valid MX record.  I have not figured out how to set the from in the headers of the message.

I can whitelist the IP, but that does not solve the underlying issue for me.


Posted By: LogSat
Date Posted: 19 January 2007 at 8:17pm
The only sender's email address that matters to SpamFilter is the one given in the MAIL FROM command. That is sometimes indicated as the "envelope" or "return path" address. SpamFilter will add the address that was specified by the remote server during the SMTP session in the following header to incoming emails:

X-SF-RX-Return-Path

The address that is specified in the email's "From:" header is ignored and not used by the various filters.


-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP


Posted By: Amadeus0125
Date Posted: 13 March 2009 at 1:31am

 

Hi,

jw-DBL-Update is a Yahoogroups mailinglist on which we post changes to our domain blacklist and 419 scam sender address blacklist. We send a maximum of one mailing per day to all subscribers. If you would like to be automatically notified about additions to or removals from these lists, send an e-mail to:
mailto:jw-dbl-update-subscribe@yahoogroups.com - jw-dbl-update-subscribe@yahoogroups.com

List-subscribers who use jwSpamSpy don't have to do anything to benefit, as jwSpamSpy automatically updates its local blacklists whenever it sees DBL-Update messages.



-------------
http://www.certpaper.com/70-293.htm - 70-293



Print Page | Close Window