Can you post the entry you used?

Dan S.

"OK ... the question was meant to ask if you have used RegEx, or wildcards or just the domain name in your black list.  Also,  if you take the word-wrapping out of your posted logs, it is easier to see that this is the log for 2 messages .... one with PID 7924 and one with PID 6824 so I think you may have confused your analysis somewhat.   OR ... am I looking at 2 differant server logs?  Perhaps I am confused."

I did not use any regex, just the domain name. sorry about the word wrapping...

It is one server log and yes I noticed that about the PID numbers being different, but from as far as I can tell it is the same message. I went back through my logs and all messages (there are pleny) that initially come from in.roving.com look like this. It is weird.
I have since blocked "in.roving.com" by adding it to my domain black list file and I have confirmed that it works now.

But I am confused as to how the message initially appears to be from one email address, but then spamfilter reports it as a different from address when it forwards it to its final destination.

Thanks again.

Hmm ... not sure I understand that.  However,  I looked in my logs and found a zillion entries for "roving.com".  I saw nothing like your magic change.  I did some digging though and unfortunately, Roving.com is a ligit service and it seems as though many of our customers get crap from them and are not complaining (yet).  Out of all the messages, only one of our customers are blocking them and it was a keyword that dinged those messages.

I looked very closely at the message content of the ones that were blocked and my "satandard" filters will not block them because they seem to follow the basic rules of being CAN-SPAM Act compliant.  I, however, take acception to any service that has to advertize that they are compliant.  It just means the they are skirting the edge of the LEGAL defination of SpamWare.

Oh well ...

Dan S.

Keizersozay,

The following line:

07/02/04 10:37:29:816 -- (7924) Mail from: mailto:ESC1011304316885_1011145214232_4201@in.roving.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - ESC1011304316885_1011145214232_4201@in.roving.com

in your log snippet shows that an incoming email has arrived, and the sender specified "@in.roving.com" in the "MAIL FROM" smtp command. The MAIL FROM indicates the sender, and should be identified in the "Return-Path" email headers.

The sender however then proceeds to indicate a different email address in the "From:" email headers. The "From:" header determines what most email clients show in the "From" field, but please note that this is different from the real sender.

SpamFilter's blacklist will work only on the "MAIL FROM" email address. In the logfile you see the entry:

07/02/04 10:37:31:503 -- (6824) Sending email from alist@bostonsalist.com to mailto:srx@m.com" CLASS="ASPForums" TITLE="WARNING: URL created by poster. - srx@m.com

SpamFilter will log the "From:" header when forwarding the email to your destination smtp server rather than the MAIL FROM address so that the log will reflect the mismatch and help identifying emails that would possibly not appear in the logs, had we chosen to stick with only one of the MAIL FROM or "From:" headers.

Roberto F.
LogSat Software

Thanks Dan.