Print Page | Close Window

AutoWhitelist problems

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5989
Printed Date: 03 June 2025 at 3:50am


Topic: AutoWhitelist problems
Posted By: clator
Subject: AutoWhitelist problems
Date Posted: 22 February 2007 at 5:21pm
I've noticed a ton of spam getting in lately, mostly of two varieties.  Either with the VAR114/VAR115 subject, or with a subject of some random Biblical-esque saying.  They almost always have pharmaceutical content inside on a big image.

I was curious as to how they were getting in, and looked in my SpamFilter logs to find the most recent one.  Apparently it was AutoWhiteListed, but I cannot figure out why.  The header itself contains the phrase "X-SF-WhiteListedReason: AutoWhiteList Force Delivery" ... could that be it?

Can I send somebody the details in email so they do not get posted publicly?


Replies:
Posted By: LogSat
Date Posted: 22 February 2007 at 5:33pm
Yeap... that's the main reason. The emails are being whitelisted due to an entry in your AutoWhiteListForceDelivery.txt file.
When you force-deliver an email that was in the quarantine, the sender is automatically matched with the recipient. From then on, all emails from that sender to that recipient are automatically whitelisted. The entry:

from@sender.com|to@recipient.com

will be added to your AutoWhiteListForceDelivery.txt file. Looking at the email yo ujust received, look at the address specified in the "X-SF-RX-Return-Path" or the "Return-Path" headers. That's you sender, and most likely you'll find them in the AutoWhiteListForceDelivery file. If so, simply delete that line from the file, no need to stop/restart SpamFilter...

-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: clator
Date Posted: 22 February 2007 at 7:17pm
Excellent.  I never understood that file before your explanation.  I've edited it and restarted.  Hopefully this will help.

Posted By: Radu
Date Posted: 03 April 2007 at 5:13am

Does it mean that all spammers who include "X-SF-WhiteListedReason: keyword whitelist match" can bypass the spam filter?

 

Posted By: lyndonje
Date Posted: 03 April 2007 at 7:58am
Hi Radu,

No that is not the case.

That is the header added by SF when a keyword whitelist match is detected.

This header is NOT checked by SF to determine whether or not an email should be classed as spam.

Regards
Lyndon.


Print Page | Close Window