Print Page | Close Window

Relationship of MAPS and SPF filters question.

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=4498
Printed Date: 31 July 2025 at 11:11am


Topic: Relationship of MAPS and SPF filters question.
Posted By: Guests
Subject: Relationship of MAPS and SPF filters question.
Date Posted: 28 October 2004 at 11:22am
The SPF Filter on our SPAM Filter server has been set so that it rejects messages that have a SPF 'Fail' result, but allows through those with a 'Softfail' or 'Neutral' result.

If a message comes from a blacklisted IP address, but the SPF result for the domain it appears to be from is ‘Softfail’ then will it be blocked or allowed through? Do messages need to pass both the MAPS and SPF tests, or will passing one them allow a message though? Does the SPF filter result have priority over the MAPS one?

Thanks for your help, Pete.


Replies:
Posted By: LogSat
Date Posted: 30 October 2004 at 12:47am

Pete,

The order with which the black/white lists are tested cannot be changed. All the white lists are checked first. If a match is found, the blacklists are skipped, the email recipients are accepted, and SpamFilter is ready to accept the data command. If none of the whitelists are matched, then the blacklists are currently searched in order below.

   1. Allowed Domains
   2. Local Domain BlackList
   3. Local Emails Blacklist
   4. Local Emails TO Blacklist
   5. Not in Authorized TO Emails
   6. Country Blacklist
   7. Reject No Reverse DNS
   8. Reject Empty Mail From
   9. Reject Same To From Email address
  10. Reject Same To From Domain
  11. Recipient Count > Max RCPTTO
  12. MAPS check
  13. Attachment Filter
  14. Keywords
  15. Bayesian Filtering

The only exception to the whitelist is the "whitelist keyword check". In order for that to work, the message has to be received first, and for this reason even if the senders is blacklisted by other filters, the email will still be received so that it can be checked against the keyword whitelist.

To answer your question then, once any blacklist "hits", all further blacklist checks are skipped.

Roberto F.
LogSat Software

Posted By: kspare
Date Posted: 30 October 2004 at 3:32pm
Hey Roberto, one thing I keep thinking about is how nice it would be to have the file filter as the first black list, would be much easier to delete all the virus's etc out by deleteing messages with bad attachments.

Posted By: LogSat
Date Posted: 31 October 2004 at 8:20pm
Kevin,

In order to use a file/keyword filter, the mesage has to be received in its entirety so the body content can be retrieved. For this reason these filters are used last, as it is much faster to block the email by looking at the IP/sender/domains since these are seen immediatley, before the mail content is sent.

Roberto F. LogSat Software

Posted By: kspare
Date Posted: 31 October 2004 at 8:38pm

Understandable. But, what about people who quaruntine all mail, in that event they recieve the entire message anyway, so either way they have the whole message.

Something to think about anyway, it would just make it easier to manage the spam database.

Posted By: Guests
Date Posted: 02 November 2004 at 12:03pm
>To answer your question then, once any blacklist "hits", all >further blacklist checks are skipped.To answer your question then, once any blacklist "hits", all >further blacklist checks are skipped.To answer your question then, once any blacklist "hits", all >further blacklist checks are skipped.further blacklist checks are skipped.further blacklist checks are skipped.

Thank you for your detailed reply.

I seem to have set up a situation where having SPF filtering turned on results in more unwanted messages getting through Spamfilter than if it is turned off:

I have published an SPF record for the 'glos.ac.uk' domain with 'softfail'. (I'm still trying to round up all the users sending mail from this domain through servers other than the main University one.)

A machine out on the Net has become infected with the Bagle virus and is sending us a stready stream of messages, many of which have the from address forged to appear from 'glos.ac.uk' addresses. The IP addresses these messages are coming from has been blacklisted by Spamhaus. With the SPF filter off they are rejected. If the SPF filter is on, with the option to pass 'softfail' messages, then the messages forged to be from 'glos.ac.uk' addresses are passed through. The pass softfail result from the SPF filter means that the Spamhaus blacklist is not checked.

For this reason I have switched off the SPF filter.

Please could the Sender Policy Framework filter be given a lower priority than the MAPS lookups, so a message's SPF status is only checked if its point of origin has not been blacklisted.


Posted By: LogSat
Date Posted: 04 November 2004 at 12:28am

Pete,

If the SPF filter is on and sees a "softfail", and you have configured SpamFilter to allow it thru, then the next filters should be checked. I just noticed that I did not inlcude the SPF filter in the list I provided earlier. The updated filter list and order of checks is as follows below. Roght after the SPF filter comes the MAPS, which should reject the email if the IP is listed in Spamhaus as you mentioned.

If you can zip and email us a copy of your SpamFilter.ini file, a copy of SpamFilter's activity log for a day when this happened, along with the IP i question, we'll try to see what is happening.

Roberto F.
LogSat Software

    1. Allowed Domains
   2. Local Domain BlackList
   3. Local Emails Blacklist
   4. Local Emails TO Blacklist
   5. Not in Authorized TO Emails
   6. Country Blacklist
   7. Reject No Reverse DNS
   8. Reject Empty Mail From
   9. Reject Same To From Email address
  10. Reject Same To From Domain
  11. Recipient Count > Max RCPTTO
  12. SPF Filter
  13. MAPS check
  14. Attachment Filter
  15. Keywords
  16. Bayesian Filtering

 

Posted By: LogSat
Date Posted: 10 November 2004 at 6:49pm
Pete,

You were absolutely correct in your observations. Thank you for all your log analysis, we were able to reproduce the problem. It turned out that if the SPF filter returned a softfail or neutral, the MAPS RBL and the local IP blacklist checks were not being performed.

We found that the bug was present in all versions up to 2.1.2.391. In build 2.1.2.392 we patched an issue with the MX filter that had the side effect of fixing the issue you discovered. It was not until you pointed out the problem however that we noticed that there was indeed a problem, and that it was "inadvertently" fixed starting from build 2.1.2.392.

If you login the registered user are of the website you'll be able to download the latest build (393), which should solve the issue.

Thanks again for the report.

Roberto F. LogSat Software

Posted By: Guests
Date Posted: 11 November 2004 at 6:06am

Roberto,

Thank you for your rapid response. I've installed the 393 build without any problems and SPF filtering is now switched back on.

Regards,

Pete.


Print Page | Close Window