Spam Filter ISP Forums : Black list "From email" https://www.logsat.com/spamfilter/forums/ Mon, 13 Apr 2026 10:44:05 +0000 Tue, 17 Jul 2007 22:12:24 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 11.04 360 https://www.logsat.com/spamfilter/forums/RSS_post_feed.asp?TID=6145 <![CDATA[Spam Filter ISP Forums]]> https://www.logsat.com/spamfilter/forums/forum_images/web_wiz_forums.png https://www.logsat.com/spamfilter/forums/ <![CDATA[Black list "From email" : I honestly do not think it would...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6145&PID=10488&title=black-list-from-email#10488 Author: LogSat
Subject: 6145
Posted: 17 July 2007 at 10:12pm

I honestly do not think it would work. Enabling the filter that blocks emails where the "FROM domain = TO domain" should stop all the same emails that would be stopped if you added all your users in a "from blacklist". In addition, the "FROM domain = TO domain" filter should also block additional emails even from fake senders that simulate incorrect, random users from your domains, which would not be blocked by your blacklist.

Please note that SpamFilter ignores the address in the "From" header, as that is used only to display an email address in Outlook clients. The actual address being acted upon is the one specified in the "MAIL FROM" command, which is usually the same one that mail servers will add to the "Return Path". SpamFilter logs that address in the header "X-SF-RX-Return-Path".
]]> Tue, 17 Jul 2007 22:12:24 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6145&PID=10488&title=black-list-from-email#10488 <![CDATA[Black list "From email" : Well, do you guys think my method...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6145&PID=10476&title=black-list-from-email#10476 Author: Stupid
Subject: 6145
Posted: 16 July 2007 at 6:02pm

Well, do you guys think my method will work though? ]]> Mon, 16 Jul 2007 18:02:03 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6145&PID=10476&title=black-list-from-email#10476 <![CDATA[Black list "From email" : WebGuyz wrote:However, SPF...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6145&PID=10470&title=black-list-from-email#10470 Author: LogSat
Subject: 6145
Posted: 15 July 2007 at 9:52am

Originally posted by WebGuyz WebGuyz wrote:

However,  SPF doesn't do any good if the  spammer used the 'Return Path' to specify the senders name as SPF only checks the FROM: field.


Actually the "Return-Path" header cannot be used by spammers/users. The "Return Path" header is added by *mail servers* when they receive the email. It will replace whatever "Return-Path" is already present in the email, and will be populated by the mail server with the address in the "MAIL FROM" command, which is the one SpamFilter acts upon.

Please note that SpamFilter will also add another header, X-SF-RX-Return-Path, that will contain the same address we added in the "Return-Path". This is because when SpamFilter forwards an email to a server, this latter mail server will also replace the "Return-Path" with the "MAIL FROM" it receives. We just want to make sure we document in the email's headers what "MAIL FROM" was used to send the email to SpamFilter, in case this somehow changes during the email's life.
]]> Sun, 15 Jul 2007 09:52:58 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6145&PID=10470&title=black-list-from-email#10470 <![CDATA[Black list "From email" : Why not add domainkeys to the...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6145&PID=10469&title=black-list-from-email#10469 Author: mbrusl
Subject: 6145
Posted: 15 July 2007 at 3:59am

Why not add domainkeys to the mix as another filter check.  Shouldn't be that difficult to do.  Think of it this way, one of the only frontend spam filtering appz out on the market that has both.  SPF and DomainKeys.

Michael

]]> Sun, 15 Jul 2007 03:59:02 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6145&PID=10469&title=black-list-from-email#10469 <![CDATA[Black list "From email" : However, SPF doesn&#039;t do any...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6145&PID=10468&title=black-list-from-email#10468 Author: WebGuyz
Subject: 6145
Posted: 14 July 2007 at 11:21pm

However,  SPF doesn't do any good if the  spammer used the 'Return Path' to specify the senders name as SPF only checks the FROM: field.]]> Sat, 14 Jul 2007 23:21:53 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6145&PID=10468&title=black-list-from-email#10468 <![CDATA[Black list "From email" : Please note that SpamFilter acts...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6145&PID=10465&title=black-list-from-email#10465 Author: LogSat
Subject: 6145
Posted: 14 July 2007 at 11:41am

Please note that SpamFilter acts upon the addresses specified in the "MAIL FROM" and "RCPT TO" commands. Any other emails specified in the "To:" and "From:" headers are ignored as they are only used to display an address in email clients, and are not the ones emails will be delivered to.

Also please remember that, instead of using the more "Dart Vader-like" rule of blocking emails where the "from domain = to domain" you could implement an SPF (Sender Policy Framework) DNS record in your DNS. As SpamFilter does support the SPF standard, this will allow you to specify what IP networks are allowed to send emails "from" you domain.
]]> Sat, 14 Jul 2007 11:41:08 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6145&PID=10465&title=black-list-from-email#10465 <![CDATA[Black list "From email" : This has already been checked....]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6145&PID=10461&title=black-list-from-email#10461 Author: Stupid
Subject: 6145
Posted: 13 July 2007 at 12:44pm

This has already been checked. didn't not work.

Originally posted by IKILLSPAM1 IKILLSPAM1 wrote:

Hey Stupid, lol, well that is your name. An easier approach would be to go into Filter Settings and check off From domain = To Domain

This would block your example above. I do this as well.

]]> Fri, 13 Jul 2007 12:44:17 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6145&PID=10461&title=black-list-from-email#10461 <![CDATA[Black list "From email" : Hey Stupid, lol, well that is...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6145&PID=10460&title=black-list-from-email#10460 Author: IKILLSPAM1
Subject: 6145
Posted: 13 July 2007 at 12:09pm

Hey Stupid, lol, well that is your name. An easier approach would be to go into Filter Settings and check off From domain = To Domain

This would block your example above. I do this as well.

]]> Fri, 13 Jul 2007 12:09:20 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6145&PID=10460&title=black-list-from-email#10460 <![CDATA[Black list "From email" : If you put your mail server&#039;s...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6145&PID=10453&title=black-list-from-email#10453 Author: mbrusl
Subject: 6145
Posted: 13 July 2007 at 12:14am

If you put your mail server's smtp on an alternate port and let Spamfilter handle both incoming and outgoing, I beleave you wont have to problem that much.  Spamfilter is capable of handling authentication for your users then handing off mail to your mail server to actually do the sending of the mail.  This is the way I have mine setup and it traps all spam on both sides.  It also tells me if a user on the network has been abusing/sending spam.]]> Fri, 13 Jul 2007 00:14:56 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6145&PID=10453&title=black-list-from-email#10453 <![CDATA[Black list "From email" : I am thinking to put all our users...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6145&PID=10451&title=black-list-from-email#10451 Author: Stupid
Subject: 6145
Posted: 12 July 2007 at 2:32pm

I am thinking to put all our users email addresses into Blacklist "From email." The Spamfilter ISP is not our outgoing SMTP server; it is a receiving only.

The reason for doing this is that very often spammer would spoof the From email address like this:

From: John@abc.com
To: Jane@abc.com

I got questions from users like every other day.

Is this a good strategy?
]]> Thu, 12 Jul 2007 14:32:18 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6145&PID=10451&title=black-list-from-email#10451