https://www.logsat.com/spamfilter/forums/ Tue, 18 Aug 2026 01:57:16 +0000 Fri, 29 Sep 2006 15:40:31 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 11.04 360 https://www.logsat.com/spamfilter/forums/RSS_post_feed.asp?TID=5814 https://www.logsat.com/spamfilter/forums/forum_images/web_wiz_forums.png https://www.logsat.com/spamfilter/forums/ https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5814&PID=9070&title=sfi-and-whitelisted-email-address-from#9070 Author: LogSat
Subject: 5814
Posted: 29 September 2006 at 3:40pm

We recommend *not* whitelisting your domain, since, as you already noticed , spammers will spoof it to send you emails.

To protect administrators from this, there is already a very efficient solution. It's SPF (Sender Policy Framework). Please see www.openspf.org for more details. In short however, SPF is used by administrators to identify, via DNS, the servers/subnets that are authorized to send emails using your domain name.

If a mail server supports SPF (SpamFilter does...), when an email arrives from a domain, the server will query the domain's DNS for their SPF record. The SPF record will tell the server if that IP is authorized to send emails for that domain. If it's not, the email is rejected.
]]> Fri, 29 Sep 2006 15:40:31 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5814&PID=9070&title=sfi-and-whitelisted-email-address-from#9070 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5814&PID=9068&title=sfi-and-whitelisted-email-address-from#9068 Author: __M__
Subject: 5814
Posted: 29 September 2006 at 4:08am

Hey all (and Roberto in particular),

SFI is working great here and is well exceeding my expectations howeverI have a problem that there may be a current workaround for or maybethis "hole" may need to be added to the wishlist for investigation.

If a spammer sends us mail using our domain (eg mydomain.com) that isbeing spoofed and the same domain (mydomain.com) is in the ExcludedFROM Emails whitelist the message will bypass the filters. Is thereanyway whatsoever to have other filters (blacklist type) overidewhitelist rules?

Maybe something like :overide at the end of the blacklist entry rule could take priority over any whitelisting.

Examples

In HoneyPot or FROM Emails it would be spoofuser@mydomain.com:overide (obviously this couldnt reflect a real email address).

In Keywords Filter it would be email advertise like this:overide

Whilst we could just remove mydomain.com from the whitelist Iwould prefer to keep the domain listed to ensure that users sendingmail from there home's ISP are less likely to experiance problems whentheir ISP's server is blacklisted.

Any ideas on an existing solution or have you come across this scenerio Roberto.

]]> Fri, 29 Sep 2006 04:08:26 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5814&PID=9068&title=sfi-and-whitelisted-email-address-from#9068