Spam Filter ISP Forums : Whitelist issue https://www.logsat.com/spamfilter/forums/ Sat, 07 Mar 2026 16:49:49 +0000 Wed, 27 Jun 2007 16:23:56 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 11.04 360 https://www.logsat.com/spamfilter/forums/RSS_post_feed.asp?TID=6111 <![CDATA[Spam Filter ISP Forums]]> https://www.logsat.com/spamfilter/forums/forum_images/web_wiz_forums.png https://www.logsat.com/spamfilter/forums/ <![CDATA[Whitelist issue : It is an odd coincidence. The...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6111&PID=10389&title=whitelist-issue#10389 Author: LogSat
Subject: 6111
Posted: 27 June 2007 at 4:23pm

It is an odd coincidence. The symptoms are very similar to the ones corymckee was having with MailGuard. There is an SMTP session established, and right when the remote server is about or has just started to send the email body itself, the connection is being dropped.

Any chance you can place a network sniffer on the network, or install either Ethereal or Microsoft's network Monitor on the SpamFilter server to capture traffic to/from the remote server so we can better see what is happening?
]]> Wed, 27 Jun 2007 16:23:56 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6111&PID=10389&title=whitelist-issue#10389 <![CDATA[Whitelist issue : No, I have a Sonicwall in front...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6111&PID=10385&title=whitelist-issue#10385 Author: BigTex71
Subject: 6111
Posted: 27 June 2007 at 1:11pm

No, I have a Sonicwall in front of my spamfilter box.  Its port forwarding SMTP traffic through to the NAT IP address of spamfilter.  No other sending domains have this issue and mail works flawlessly otherwise. I'll take another look through the sonicwall, but I know there isn't any mail filtering enabled directly on it.

Thanks for the reply.]]> Wed, 27 Jun 2007 13:11:26 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6111&PID=10385&title=whitelist-issue#10385 <![CDATA[Whitelist issue : Exact same problem we had. Do...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6111&PID=10383&title=whitelist-issue#10383 Author: corymckee
Subject: 6111
Posted: 27 June 2007 at 12:56pm

Exact same problem we had. Do you have mailguard (or similar) enabled on your firewall?]]> Wed, 27 Jun 2007 12:56:11 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6111&PID=10383&title=whitelist-issue#10383 <![CDATA[Whitelist issue : Thank you Roberto, but it doesn&#039;t...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6111&PID=10381&title=whitelist-issue#10381 Author: BigTex71
Subject: 6111
Posted: 27 June 2007 at 11:58am

Thank you Roberto, but it doesn't appear to be a timeout issue.  I'm seeing this in the activity log and it shows disconnect about a second after the last command.

06/26/07 12:24:16:960 -- (1816) Connection from: 12.13.14.15  -  Originating country : United States
06/26/07 12:24:17:195 -- (1816) Mail from: Lonnie_Leger@senderdomain.Com
06/26/07 12:24:17:867 -- (1816) - MAPS search done...
06/26/07 12:24:17:867 -- (1816) RCPT TO: cdaunis@ourdomain.com accepted
06/26/07 12:24:18:914 -- (1816) Disconnect

I just tried editing the .ini file to disable EHLO extensions, but ended up with the same disconnect result. 

I'm not 100% sure, but I think I was able to receive the whole message properly once when I accidentally had their mail going to quarantine.  I'll manually blacklist them again and see if the messages actually do get completed and sent to quarantine.
]]> Wed, 27 Jun 2007 11:58:56 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6111&PID=10381&title=whitelist-issue#10381 <![CDATA[Whitelist issue : Richard,MailGuard was on the recipient...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6111&PID=10371&title=whitelist-issue#10371 Author: LogSat
Subject: 6111
Posted: 26 June 2007 at 8:19am

Richard,

MailGuard was on the recipient side (the customer running SpamFilter). Please also note that SpamFilter has a built-in timeout that will disconnect remote clients if they remain connected for too long. This *could* cause a problem for connections with very slow links. You will see this happening in the logs however, as the disconnect will occur several minutes (20 by default) after the connection is established.

This timeout can be changed by editing the following line in the SpamFilter.ini file (no restart of SpamFilter is necessary):

;Force disconnect of sessions after they have remained connected for this long
IdleDisconnectMinutesTimeout=20


]]> Tue, 26 Jun 2007 08:19:24 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6111&PID=10371&title=whitelist-issue#10371 <![CDATA[Whitelist issue : Was the mailguard located on...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6111&PID=10369&title=whitelist-issue#10369 Author: BigTex71
Subject: 6111
Posted: 25 June 2007 at 5:07pm

Was the mailguard located on the senders side or the recipients side? 

I have a very similar situation where mail from one domain disconnects before finishing the message.  The senders get a delivery failure report stating that the server lost connection while sending end of data.  In troubleshooting the issue, I have found that the senders have recently added a Tumbleweed MailGate to their environment. 

I'm running the current version of spamfilter and have tested it with the last 2.x version, as well as moving the spamfilter to an alternate machine.  Debug shows this:

>>EHLO plamg01.senderdomain.com
<<250-8BITMIME
<<250-SIZE 12800000
<<250 HELP
>>MAIL FROM:<Bill_Miller@senderdomain.Com> SIZE=4424
<<250  Address Okay
>>RCPT TO:<cdaunis@ourdomain.com>
<<250 cdaunis@ourdomain.com Address Okay
>>DATA
<<354 Start mail input; end with <CRLF>.<CRLF>
>>EHLO plamg01.senderdomain.com
<<250-8BITMIME
<<250-SIZE 12800000
<<250 HELP
>>MAIL FROM:<Bill_Miller@senderdomain.Com> SIZE=4424
<<250  Address Okay
>>RCPT TO:<cdaunis@ourdomain.com>
<<250 cdaunis@ourdomain.com Address Okay
>>DATA
<<354 Start mail input; end with <CRLF>.<CRLF>

Any help would be appreciated.
Richard


Edited by BigTex71]]> Mon, 25 Jun 2007 17:07:28 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6111&PID=10369&title=whitelist-issue#10369 <![CDATA[Whitelist issue : The issue was caused by Cisco&#039;s...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6111&PID=10355&title=whitelist-issue#10355 Author: LogSat
Subject: 6111
Posted: 21 June 2007 at 4:32pm

The issue was caused by Cisco's MailGuard on the firewall. Disabling MailGuard solved the problem.]]> Thu, 21 Jun 2007 16:32:42 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6111&PID=10355&title=whitelist-issue#10355 <![CDATA[Whitelist issue : It turns out that this is still...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6111&PID=10353&title=whitelist-issue#10353 Author: corymckee
Subject: 6111
Posted: 20 June 2007 at 12:53pm

It turns out that this is still a problem. It has nothing to do with the vendor being whitelisted. It continues to happen regardless.

I ran a debug and I will email you the results. I am trying to collect more as well.

]]> Wed, 20 Jun 2007 12:53:52 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6111&PID=10353&title=whitelist-issue#10353 <![CDATA[Whitelist issue : I will try to do this, but it...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6111&PID=10346&title=whitelist-issue#10346 Author: corymckee
Subject: 6111
Posted: 19 June 2007 at 12:54pm

I will try to do this, but it is a major vendor and I do not know if we can work with anyone on thier team to get it resolved. I can not seem to reporduce the problem with other whitelisted domains after some tests last night.

I will let you know if I am able to work directly with the vendor on this.

]]> Tue, 19 Jun 2007 12:54:08 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6111&PID=10346&title=whitelist-issue#10346 <![CDATA[Whitelist issue : This is very strange indeed. Probably...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6111&PID=10342&title=whitelist-issue#10342 Author: LogSat
Subject: 6111
Posted: 18 June 2007 at 11:26pm

This is very strange indeed. Probably the best way to find out what is happening is to perform a trace of the SMTP session with the remote host, if possible, under the two conditions (whitelisted / not whitelisted).

SpamFilter can do that by going to the "Settings - Debug View" tab. In there, if you enter the IP of the remote host and check the "Enable Debug Monitor" box, SpamFilter will show a trace of the SMTP traffic on the next connections.

If you could either post or email us those results we can try to figure ourt what is happening.
]]> Mon, 18 Jun 2007 23:26:58 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6111&PID=10342&title=whitelist-issue#10342