Spam Filter ISP Forums : Too Much Spam Still Getting Through https://www.logsat.com/spamfilter/forums/ Wed, 11 Mar 2026 05:56:41 +0000 Wed, 10 Sep 2008 17:20:59 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 11.04 360 https://www.logsat.com/spamfilter/forums/RSS_post_feed.asp?TID=6360 <![CDATA[Spam Filter ISP Forums]]> https://www.logsat.com/spamfilter/forums/forum_images/web_wiz_forums.png https://www.logsat.com/spamfilter/forums/ <![CDATA[Too Much Spam Still Getting Through : Thanks LogSat. I made some changes...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6360&PID=12386&title=too-much-spam-still-getting-through#12386 Author: lewiskerns
Subject: 6360
Posted: 10 September 2008 at 5:20pm

Thanks LogSat.  I made some changes earlier today to my MAPS and SURBL lists, as well as updated my DNS servers and they seem to be catching emails now.

 

]]> Wed, 10 Sep 2008 17:20:59 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6360&PID=12386&title=too-much-spam-still-getting-through#12386 <![CDATA[Too Much Spam Still Getting Through : lewiskerns, If you can zip and...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6360&PID=12384&title=too-much-spam-still-getting-through#12384 Author: LogSat
Subject: 6360
Posted: 10 September 2008 at 4:44pm

lewiskerns,

If you can zip and email us (support @ logsat.com) about one hour's worth of activity from your SpamFilter activity logfile, we'll be glad to look into this for you. Please include your SpamFilter.ini file, and your entire SpamFilter\domains directory structure (all files and folders).]]> Wed, 10 Sep 2008 16:44:38 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6360&PID=12384&title=too-much-spam-still-getting-through#12384 <![CDATA[Too Much Spam Still Getting Through : LogSat, I&#039;m having similar...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6360&PID=12380&title=too-much-spam-still-getting-through#12380 Author: lewiskerns
Subject: 6360
Posted: 10 September 2008 at 9:55am

LogSat,
I'm having similar problems with those filters not stopping any spam.  Can you elaborate on the changes you made to the DNS servers?  Currently, I'musing my local router as well as my ISP's DNS.
]]> Wed, 10 Sep 2008 09:55:03 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6360&PID=12380&title=too-much-spam-still-getting-through#12380 <![CDATA[Too Much Spam Still Getting Through : For the record, the logs showed...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6360&PID=11613&title=too-much-spam-still-getting-through#11613 Author: LogSat
Subject: 6360
Posted: 25 January 2008 at 9:43pm

For the record, the logs showed that the MAPS RBLs, the SURBLs and the SPF filters where not stopping any spam. Further research pinpointed the problem with the DNS servers that SpamFilter was using. None of the DNS servers were configured as forwarders, and thus all DNS queries were not being answered. Changing DNS servers allowed all the above 3 filters to function again.]]> Fri, 25 Jan 2008 21:43:26 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6360&PID=11613&title=too-much-spam-still-getting-through#11613 <![CDATA[Too Much Spam Still Getting Through : saracen, just my 2 cents worth: Persist...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6360&PID=11597&title=too-much-spam-still-getting-through#11597 Author: __M__
Subject: 6360
Posted: 22 January 2008 at 2:06am

saracen, just my 2 cents worth:
 
Persist with the configuration of SFI as from our testing it is the most accurate, affordable and best supported anti-spam product going around.
 
I'm a big fan-boy because the product is so great (and keeps getting greater).
 
Mike
]]> Tue, 22 Jan 2008 02:06:24 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6360&PID=11597&title=too-much-spam-still-getting-through#11597 <![CDATA[Too Much Spam Still Getting Through : Thank you. I&#039;ve gathered...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6360&PID=11593&title=too-much-spam-still-getting-through#11593 Author: saracen
Subject: 6360
Posted: 21 January 2008 at 9:05pm

Thank you. I've gathered the logs and config files and will be sending them in tonight.
]]> Mon, 21 Jan 2008 21:05:38 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6360&PID=11593&title=too-much-spam-still-getting-through#11593 <![CDATA[Too Much Spam Still Getting Through : saracen,Most likely this is either...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6360&PID=11591&title=too-much-spam-still-getting-through#11591 Author: LogSat
Subject: 6360
Posted: 21 January 2008 at 6:48pm

saracen,

Most likely this is either caused by a misconfiguration in SpamFilter, or it is due to the fact that SpamFilter is not seeing the "real" IP address of the sender (this happens if you have another server process the emails before they reach SpamFilter, or if your firewall masks the IPs from the internet when NAT'ting them). If you can please zip and email us (support at logsat dot com) about one hour worth of logs from SpamFilter's activity logfile, along with the SpamFilter.ini file, and you let us know what version of SpamFilter you're using, we'll try to help.
Please also include the various text files containing your configuration files, especially the one containing the list of your local domains.
]]> Mon, 21 Jan 2008 18:48:10 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6360&PID=11591&title=too-much-spam-still-getting-through#11591 <![CDATA[Too Much Spam Still Getting Through : I am not trying to step on Roberto&#039;s...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6360&PID=11590&title=too-much-spam-still-getting-through#11590 Author: Stupid
Subject: 6360
Posted: 21 January 2008 at 6:47pm

I am not trying to step on Roberto's toes, but if you want, you can post spamfilter.ini and filters.ini. we can probably help you a bit. A lot of other people here are far more knowledgeable too.

It takes some time to tune it and it also depends on your attractiveness. I run a very small shop and majority of my spam is caught under "honeypots."

1. Set up some keywords that you are sure your clients are not using.
2. Set up MAPS, SURBL, Attachments, SFDB, Filters (reject if no reverse DNS, invalid MX, Mail From=Mail TO, From Domain=To Domain)
3. Monitor a while, then turn on Country filters
4. Start to use Honeypots




Edited by Stupid - 21 January 2008 at 6:49pm]]> Mon, 21 Jan 2008 18:47:27 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6360&PID=11590&title=too-much-spam-still-getting-through#11590 <![CDATA[Too Much Spam Still Getting Through : Currently, there is still a good...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6360&PID=11588&title=too-much-spam-still-getting-through#11588 Author: saracen
Subject: 6360
Posted: 21 January 2008 at 5:34pm

Currently, there is still a good amount of Spam getting through Spam Filter ISP when compared to other solutions we've had in place.

Over the course of a day I will get 15-20 messages that are spam in my inbox while only 2-4 show up in my quarantine. I know that more is getting disconnected based on being from foreign addresses, etc. but more is getting through than what we experienced with previous solutions. For example, with a competing product I would get2-4 messages per week in my inbox.

Also, I'm finding that clients of ours are having their emails rejected by the spam filter unless they are added to the domain-to-domain whitelist. Yet, nothing in the content once it's received is indicative of spam (they get an NDR that states that there was a spam signature embedded in the message).

Additionally, our clients that we have going through the filter also report the same things, that companies sending email to them get rejected unless defined in the domain-to-domain filter yet they continue to receive emails that are clearly and unquestionably spam in their inboxes.

One of the things we love about the product is that it drops connections from most sources limiting the bandwidth being used, but it's frustrating to our clients that mail that is clearly spam gets through while legitimate email is rejected unless the domain is whitelisted.

Any thoughts as to why this is happening?




]]> Mon, 21 Jan 2008 17:34:03 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6360&PID=11588&title=too-much-spam-still-getting-through#11588