Print Page | Close Window

From Domain = To Domain

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5894
Printed Date: 01 June 2025 at 7:44am


Topic: From Domain = To Domain
Posted By: Stupid
Subject: From Domain = To Domain
Date Posted: 30 November 2006 at 11:36am

Our SFI is setup as "receiving" only, but there are many emails coming in as From: mailto:aaa@abc.com - aaa@abc.com , To: mailto:bbb@abc.com - bbb@abc.com (as appeared in Outlook).

Why doesn't the From Domain = To Domain filter catch it?


Replies:
Posted By: WebGuyz
Date Posted: 30 November 2006 at 3:06pm

Double check that you don't have mailto:*@abc.com - *@abc.com in a whitelist anywhere or in autowhitedelivery.txt

Check the log for those actual entries and see if they are being whitelisted for any reason.



-------------
http://www.webguyz.net

Posted By: __M__
Date Posted: 01 December 2006 at 5:15am
Checking the message headers might also shed some light, SFI will make entries in the X-SF area to describe how it's processed the mail.

Posted By: LogSat
Date Posted: 01 December 2006 at 4:25pm
Also please note that SpamFilter acts on the MAIL FROM address provided during the SMTP session, *not* the "From:" header in the email. You can verify what the "MAIL FROM" that SpamFilter was given by looking at the header:

X-SF-RX-Return-Path:

If an email was whitelisted for any reason (or marked as "tag spam"), the following header, along with the reason, will be present:

X-SF-WhiteListedReason:


-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: Stupid
Date Posted: 04 December 2006 at 9:19am

No, it's not listed in autowhiteforcedelivery.txt

I know SPI checks MAIL FROM address provided during the SMTP session, *not* the "From:" header in the email, can't it check both? or at least give us the option to check either one?

 


Print Page | Close Window