Print Page | Close Window

Does FROM blocking work in .178 ?

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=2433
Printed Date: 04 November 2025 at 4:02am


Topic: Does FROM blocking work in .178 ?
Posted By: Lee
Subject: Does FROM blocking work in .178 ?
Date Posted: 18 November 2003 at 3:05pm

I have been trying to block spam from someone posing as microsoft but I can not get Spamfilter .178 to block this email.

From: "Microsoft" < mailto:security@microsoft.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - security@microsoft.com >
To: < mailto:Newsdesk@AmericanMotor.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - Newsdesk@AmericanMotor.com >
Subject: Use this patch immediately !

Shouldn't simply putting mailto:security@microsoft.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - security@microsoft.com in the blacklist From file do it ?  Is this an operator error (ME) or a bug in .178 ?

Thanks,

Lee


Replies:
Posted By: LogSat
Date Posted: 18 November 2003 at 11:03pm

Lee,

The blacklist "From" filter works based on the "MAIL FROM" address that is specified by the remote server, not the "From:" header in the email content. You should be able to see the original MAIL FROM address by looking at the "Return-Path" address in the email header.

Roberto F.
LogSat Software

Posted By: Lee
Date Posted: 19 November 2003 at 12:08am

Roberto, as usual I learn some thing new every time I talk to you. :)

Does this also apply to the DOMAIN filter ?

From: "Microsoft" http://mail.3dnet.com:883/Xfa0793ccc8ccc9ce989f6a02aaab/newmsg.cgi?mbx=Deleted&to=security@microsoft.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - <security@microsoft.com>
Received: (qmail 26673 invoked from network); 18 Nov 2003 22:07:48 -0000
Received: from unknown (HELO localhost) (64.122.20.32)
  by apbauto.com with SMTP; 18 Nov 2003 22:07:48 -0000
To: mailto:webmaster@domain.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - webmaster@domain.com
Subject: Use this patch immediately

Here is the header so is the :
 "Received: from unknown (HELO localhost) (64.122.20.32)"

 Is this the portion of the header you are talking about ?

Lee

Posted By: LogSat
Date Posted: 19 November 2003 at 11:39pm

That's why we're here!

Yes, the same applies for the domain filter.

Roberto F.
LogSat Software

 


Print Page | Close Window