In what order does SpamFilter detect spam?  Looking at the log it must process whitelisted info first.  Then what does it do?  Does it quit checking once it matches a blacklist or does it continue and find possibly more matches.  I'd like to know how to best configure my blacklists for different detection levels so can better use the "do not quarantine" feature.

By the way, great product! 

Thanks for your help.

Brice,

All the white lists are checked first. If a match is found, the blacklists are skipped, the email recipients are accepted, and SpamFilter is ready to accept the data command. If none of the whitelists are matched, then the blacklists are searched in the following order:

1. Local FROM Domains Blacklist
2. Local FROM Emails Blacklist
3. No Reverse DNS (this is calculated at connection time)
4. Reject Empty Mail From
5. Reject Same To/From
6. Recipient Count > Max RCPT TO
7. Country Blacklisted
8. Local Emails TO Blacklist
9. Authorized TO Emails
10. Allowed Domains
11. MAPS check
12. Keywords check

The only exception to the whitelist is the "whitelist keyword check". In order for that to work, the message has to be received first, and for this reason even if the senders is blacklisted by other filters, the email will still be received so that it can be checked against the keyword whitelist.

Once a blacklist "hits", all further blacklist checks are skipped.

Roberto F.
LogSat Software