Spam Filter ISP Forums : spam are getting through https://www.logsat.com/spamfilter/forums/ Mon, 10 Aug 2026 04:01:57 +0000 Wed, 09 Sep 2009 23:13:54 +0000 http://blogs.law.harvard.edu/tech/rss Web Wiz Forums 11.04 360 https://www.logsat.com/spamfilter/forums/RSS_post_feed.asp?TID=6742 <![CDATA[Spam Filter ISP Forums]]> https://www.logsat.com/spamfilter/forums/forum_images/web_wiz_forums.png https://www.logsat.com/spamfilter/forums/ <![CDATA[spam are getting through : SpamFilter will not be able to...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6742&PID=13182&title=spam-are-getting-through#13182 Author: LogSat
Subject: 6742
Posted: 09 September 2009 at 11:13pm

SpamFilter will not be able to stop 100% of the incoming spam. This unfortunately looks like one of the cases where the spam will be missed. The remote IP 204.110.14.48 is not currently blacklisted, the reverse DNS on it is present, there are no major issue with the sender's IP, and the content did not raise any flags.
]]> Wed, 09 Sep 2009 23:13:54 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6742&PID=13182&title=spam-are-getting-through#13182 <![CDATA[spam are getting through : Does it look like it&#039;s working?...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6742&PID=13179&title=spam-are-getting-through#13179 Author: Stupid
Subject: 6742
Posted: 09 September 2009 at 3:55pm


Does it look like it's working? This actually is a spam email and somehow it passed everything.

09/09/09 04:33:10:710 -- (7720) Detected TCP Connection: 204.110.14.48
09/09/09 04:33:10:710 -- (7720) Connection from: 204.110.14.48  -  Originating country : United States
09/09/09 04:33:10:835 -- (7720) Received MAIL FROM: <JuniorGallo@stylerank.info>
09/09/09 04:33:10:913 -- (7720) Received RCPT TO: jose.rochester@mycompany.com
09/09/09 04:33:11:022 -- (7720) Resolving 204.110.14.48 - smtp-verifiedoptin48.godsheros.com
09/09/09 04:33:11:397 -- (7720) - SPF analysis for stylerank.info done: - none
09/09/09 04:33:11:397 -- (7720) Mail from: JuniorGallo@stylerank.info
09/09/09 04:33:12:053 -- (7720) - MAPS search done...
09/09/09 04:33:12:053 -- (7720) RCPT TO: jose.rochester@mycompany.com accepted
09/09/09 04:33:12:194 -- (7720) Checking SFDC
09/09/09 04:33:12:381 -- (7720) Hash cache - Added OK
09/09/09 04:33:13:350 -- (7720) EMail from JuniorGallo@stylerank.info to jose.rochester@mycompany.com passes Bayesian filter - 0% spam  (0ms)
09/09/09 04:33:13:350 -- (7720) Checking SURBL
09/09/09 04:33:13:397 -- (7720) Checking URLs in emails against MAPS
09/09/09 04:33:13:397 -- (7720) Resolving for URLsInMAPS: www.tagopia.net
09/09/09 04:33:14:131 -- (7720) - URLs In MAPS search done...
09/09/09 04:33:14:131 -- (7720) Starting queueing procedures
09/09/09 04:33:14:131 -- (7720) EMail from JuniorGallo@stylerank.info to jose.rochester@mycompany.com was queued. Size: 1 KB, 1024 bytes
09/09/09 04:33:14:147 -- (7720) Starting bayesian procedures
09/09/09 04:33:14:147 -- (7172) Sending email from JuniorGallo@stylerank.info to jose.rochester@mycompany.com --
09/09/09 04:33:14:272 -- (7720) Disconnect

]]> Wed, 09 Sep 2009 15:55:32 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6742&PID=13179&title=spam-are-getting-through#13179 <![CDATA[spam are getting through : Thank you Roberto. I&#039;ll try...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6742&PID=13165&title=spam-are-getting-through#13165 Author: Stupid
Subject: 6742
Posted: 03 September 2009 at 11:09pm

Thank you Roberto. I'll try that and will let you know next week.]]> Thu, 03 Sep 2009 23:09:36 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6742&PID=13165&title=spam-are-getting-through#13165 <![CDATA[spam are getting through : Got it. Here&#039;s what we...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6742&PID=13163&title=spam-are-getting-through#13163 Author: LogSat
Subject: 6742
Posted: 03 September 2009 at 5:06pm

Got it. Here's what we see.
From your logs, the SPF queries are working just fine, which confirms what you say in that the DNS server is working correctly.
We moved then onto the MAPS RBL list, and we see some issues there.

This is your current list:

bl.spamcop.net, true

xbl.spamhaus.org, true

sbl.spamhaus.org, true

dnsbl.njabl.org, true

sbl.spamhaus.org, true

vox.schpider.com, true

relays.mail-abuse.org, true

dialups.mail-abuse.org, true

blackholes.easynet.nl, true

blackholes.wirehub.net, true

sbl-xbl.spamhaus.org, true

sbl-xbl.spamhaus.org, true


I crossed out lists that are currently not responding to queries, and are thus causing dns timeouts when trying to reach them. In addition, I've marked in red lists that can be combined into a single list:
zen.spamhaus.org
that combines the databases of the individual lists specified by the individual MAPS RBL servers in red.

I'd thus recommend you modify your list as follows:

bl.spamcop.net, true

zen.spamhaus.org, true

dnsbl.njabl.org, true

relays.mail-abuse.org, true

dialups.mail-abuse.org, true

blackholes.easynet.nl, true

blackholes.wirehub.net, true


and see if that helps in reducing the dns timeouts.


Edited by LogSat - 03 September 2009 at 5:07pm]]> Thu, 03 Sep 2009 17:06:49 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6742&PID=13163&title=spam-are-getting-through#13163 <![CDATA[spam are getting through : emails sent, Roberto. ]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6742&PID=13161&title=spam-are-getting-through#13161 Author: Stupid
Subject: 6742
Posted: 03 September 2009 at 9:17am

emails sent, Roberto.]]> Thu, 03 Sep 2009 09:17:37 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6742&PID=13161&title=spam-are-getting-through#13161 <![CDATA[spam are getting through : Could you please zip and email...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6742&PID=13157&title=spam-are-getting-through#13157 Author: LogSat
Subject: 6742
Posted: 02 September 2009 at 7:24pm

Could you please zip and email us your:
SpamFilter.ini file
SpamFilter's activity logfile for about 1 hour worth of emails
The text file that contains the list of your MAPS servers

So we can take a better look?
]]> Wed, 02 Sep 2009 19:24:47 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6742&PID=13157&title=spam-are-getting-through#13157 <![CDATA[spam are getting through : Done that already. Didn&#039;t...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6742&PID=13156&title=spam-are-getting-through#13156 Author: Stupid
Subject: 6742
Posted: 02 September 2009 at 5:53pm

Done that already. Didn't see anything wrong. here's mine:

Default Server:  renlive.mycompany.com
Address:  192.168.3.84

> bl.spamcop.net
Server:  renlive.mycompany.com
Address:  192.168.3.84

Name:    bl.spamcop.net
Address:  204.15.82.19

> zen.spamhaus.org
Server:  renlive.mycompany.com
Address:  192.168.3.84

Name:    zen.spamhaus.org

> 53.208.32.80.bl.spamcop.net
Server:  renlive.mycompany.com
Address:  192.168.3.84

Non-authoritative answer:
Name:    53.208.32.80.bl.spamcop.net
Address:  127.0.0.2


Edited by Stupid - 02 September 2009 at 5:57pm]]> Wed, 02 Sep 2009 17:53:54 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6742&PID=13156&title=spam-are-getting-through#13156 <![CDATA[spam are getting through : Unfortunately the DNS timeouts...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6742&PID=13155&title=spam-are-getting-through#13155 Author: LogSat
Subject: 6742
Posted: 02 September 2009 at 4:19pm

Unfortunately the DNS timeouts are usually indeed caused by the DNS servers that SpamFilter was configured to use.

You can verify this by opening an MSDOS prompt on the server running SpamFilter, and issuing the following commands in bold (replacing 192.168.2.1 with the IP address of your DNS server). Repeat the command in red 4-5 times. If you receive the 127.0.0.2 result in blue for each time, the DNS server is responding correctly at that time. If you instead receive timeouts, they are likely indicating issues with the DNS server.


c:\>nslookup
> server 192.168.2.1
Default server: 192.168.2.1
Address: 192.168.2.1#53
>  53.208.32.80.bl.spamcop.net
Server:         192.168.2.1
Address:        192.168.2.1#53

Non-authoritative answer:
Name:    53.208.32.80.bl.spamcop.net
Address: 127.0.0.2
> 

]]> Wed, 02 Sep 2009 16:19:23 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6742&PID=13155&title=spam-are-getting-through#13155 <![CDATA[spam are getting through : I looked up zen.spamhaus.org...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6742&PID=13153&title=spam-are-getting-through#13153 Author: Stupid
Subject: 6742
Posted: 02 September 2009 at 10:19am

I looked up zen.spamhaus.org on www.network-tools.com and it does not return any IP address either, nor does nslookup on the spamfilter server.

I put bl.spamcop.net on the first, but still getting DNS error.

I upgraded to 4.1.2.815 version, but still getting DNS error. What could be the cause? I really don't anything wrong with my DNS server as all of us are using it to browse Internet, send emails and perform Active Directory tasks. would you shine some light on this?

09/02/09 09:49:48:014 -- (7012) Detected TCP Connection: 72.32.66.29
09/02/09 09:49:48:030 -- (7012) Connection from: 72.32.66.29  -  Originating country : United States
09/02/09 09:49:48:186 -- (7012) Received MAIL FROM: <bounces@sm.b2bportales.com>
09/02/09 09:49:48:374 -- (7012) Received RCPT TO: contact@mycompany.com
09/02/09 09:49:48:608 -- (7012) Resolving 72.32.66.29 - sm.b2bportales.com
09/02/09 09:49:49:061 -- (7012) found SPF record for sm.b2bportales.com: v=spf1 ip4:72.32.66.29 -all
09/02/09 09:49:49:061 -- (7012) SPF query result: pass
09/02/09 09:49:49:061 -- (7012) - SPF analysis for sm.b2bportales.com done: - pass
09/02/09 09:49:49:061 -- (7012) Mail from: bounces@sm.b2bportales.com
09/02/09 09:49:54:202 -- (7012) DNS Error:TimedOut
09/02/09 09:49:54:639 -- (7012) - MAPS search done...
09/02/09 09:49:54:639 -- (7012) RCPT TO: contact@mycompany.com accepted
09/02/09 09:49:54:733 -- (7012) Checking SFDC
09/02/09 09:49:54:921 -- (7012) Hash cache - Added OK
09/02/09 09:49:59:296 -- (7012) EMail from bounces@sm.b2bportales.com to contact@mycompany.com passes Bayesian filter - 0% spam  (46ms)
09/02/09 09:49:59:296 -- (7012) Checking SURBL
09/02/09 09:49:59:577 -- (7012) Checking URLs in emails against MAPS
09/02/09 09:49:59:577 -- (7012) Resolving for URLsInMAPS: sm.b2bportales.com
09/02/09 09:50:04:592 -- (7012) DNS Error:TimedOut
09/02/09 09:50:04:592 -- (7012) Resolving for URLsInMAPS: www.b2bportales.com
09/02/09 09:50:09:827 -- (7012) DNS Error:TimedOut
09/02/09 09:50:10:249 -- (7012) Resolving for URLsInMAPS: www.plastico.com
09/02/09 09:50:15:530 -- (7012) DNS Error:TimedOut
09/02/09 09:50:15:921 -- (7012) Resolving for URLsInMAPS: sm.b2bportales=
09/02/09 09:50:15:952 -- (7012) Error occurred during URLsInMAPS: DNS Server Reports Query Name Error
09/02/09 09:50:15:952 -- (7012) Resolving for URLsInMAPS: www.pla=
09/02/09 09:50:15:999 -- (7012) Error occurred during URLsInMAPS: DNS Server Reports Query Name Error
09/02/09 09:50:15:999 -- (7012) Resolving for URLsInMAPS: sm.b2bpo=
09/02/09 09:50:16:046 -- (7012) Error occurred during URLsInMAPS: DNS Server Reports Query Name Error
09/02/09 09:50:16:046 -- (7012) - URLs In MAPS search done...
09/02/09 09:50:16:061 -- (7012) Starting queueing procedures
09/02/09 09:50:16:077 -- (7012) EMail from bounces@sm.b2bportales.com to contact@mycompany.com was queued. Size: 5 KB, 5120 bytes
09/02/09 09:50:16:077 -- (7012) Starting bayesian procedures
09/02/09 09:50:18:717 -- (7012) Disconnect




Edited by Stupid - 02 September 2009 at 10:57am]]> Wed, 02 Sep 2009 10:19:13 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6742&PID=13153&title=spam-are-getting-through#13153 <![CDATA[spam are getting through : What MAPS RBL servers do you suggest...]]> https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6742&PID=13152&title=spam-are-getting-through#13152 Author: Stupid
Subject: 6742
Posted: 02 September 2009 at 9:23am

What MAPS RBL servers do you suggest me to use? I have these but it seems the first one does not return any IP address while the rest do.

sbl-xbl.spamhaus.org, true
bl.spamcop.net, true
xbl.spamhaus.org, true
sbl.spamhaus.org, true
dnsbl.njabl.org, true
sbl.spamhaus.org, true
vox.schpider.com, true
relays.mail-abuse.org, true
dialups.mail-abuse.org, true
blackholes.easynet.nl, true
blackholes.wirehub.net, true

]]> Wed, 02 Sep 2009 09:23:02 +0000 https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6742&PID=13152&title=spam-are-getting-through#13152