Print Page | Close Window

Problem with whitelist not working

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5046
Printed Date: 09 May 2025 at 9:34am


Topic: Problem with whitelist not working
Posted By: Terry
Subject: Problem with whitelist not working
Date Posted: 06 February 2005 at 9:54am

I have noticed what seems to be a problem since I installed 2.1.2.402.  People are having message senders previously quarantined and whitelisted suddenly quarantined again even though the whitelist entry is still there...here is an excerpt of the log that I thinks shows this happening:

02/03/05 15:04:56:980 -- (2512) Connection from: 198.107.1.132  -  Originating country : United States
02/03/05 15:04:57:433 -- (3492) EMail from mailto:johnss@portptld.com - johnss@portptld.com to mailto:webmaster@portptld.com - webmaster@portptld.com was received and quarantined. Size: 40 KB, 40960 bytes
02/03/05 15:04:57:465 -- (2052) Time to add Msg to Bayes corpus:0
02/03/05 15:04:57:652 -- (2512) Resolving 198.107.1.132 - Not found
02/03/05 15:04:57:668 -- (2512) Bypassed all rules for: mailto:meeceb@portptld.com - meeceb@portptld.com from mailto:hrubin@amburgeyrubin.com - hrubin@amburgeyrubin.com
02/03/05 15:04:57:746 -- (3424) EMail from mailto:jmcelhinny@thprd.com - jmcelhinny@thprd.com to mailto:prieba@portptld.com - prieba@portptld.com   was forwarded to 10.192.34.83:25
02/03/05 15:04:57:761 -- (2512) - Reverse DNS not found -
02/03/05 15:04:57:761 -- (2512) 198.107.1.132 - Mail from: mailto:hrubin@amburgeyrubin.com - hrubin@amburgeyrubin.com To: mailto:cookro@portptld.com - cookro@portptld.com will be rejected
02/03/05 15:04:57:840 -- (3492) Disconnect
02/03/05 15:04:58:152 -- (2512) EMail from mailto:hrubin@amburgeyrubin.com - hrubin@amburgeyrubin.com to mailto:meeceb@portptld.com - meeceb@portptld.com , mailto:cookro@portptld.com - cookro@portptld.com was received and quarantined. Size: 5 KB, 5120 bytes
02/03/05 15:04:58:168 -- (2052) Time to add Msg to Bayes corpus:0
02/03/05 15:04:58:277 -- (2512) Disconnect

As you can see it says it was going to bypass all rules but it didn't and the item was quarantined?

here is the whitelist entry that existed for that entry...

mailto:hrubin@amburgeyrubin.commeeceb@portptld.com - hrubin@amburgeyrubin.com|meeceb@portptld.com

Ideas?

 

Terry




Replies:
Posted By: LogSat
Date Posted: 06 February 2005 at 10:05am
Terry,

This particular email had two recipients, not just one. The email was sent to mailto:cookro@portptld.com - cookro@portptld.com and to mailto:meeceb@portptld.com - meeceb@portptld.com . It appears that only meeceb was whitelisted, not the other recipient (cookro). SpamFilter is not able to "split" a single message addressed to multiple users, and then deliver it to the some senders while instead sending a "non -delivery notification" email for the ones that were blocked.



-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP


Posted By: Terry
Date Posted: 06 February 2005 at 10:09am
I agree that it had 2 recipients..but my understanding from earlier information is that if 1 person had that sender whitelisted then the message would be sent to all recipients.  Did that logic change?  Now all recipients have to whitelist the same sender?  That is quite a change....Terry


Posted By: LogSat
Date Posted: 06 February 2005 at 10:16am
Having one recipient whitelisted while the others are not is a tricky situation, as we do not want the rest of the users to receive massive amounts of spam if few individuals cause, unknowingly, to bypass rules for everyone. We need to thread carefully in how we program features as to avoid this from happening. We'll look into this particular issue to see if it can be changed without creating other problems.

-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP


Posted By: Terry
Date Posted: 06 February 2005 at 10:24am

Roberto, did this change?  I was told before that if a person decided to deliver an email from quarantine all recipients would receive it.  Is this not the same issue? 

Is this delivery process shown above the way it always worked?  I am surprised I haven't heard this from my users before.  Terry



Posted By: LogSat
Date Posted: 06 February 2005 at 10:23pm
Terry,

Examining your report we've discovered there's actually a bug in how such emails with multiple recipients, where one of them is whitelisted in some way, are handled. More specifically, the order in which the recipiens appear sometimes causes the email to be rejected even if one of them is whitelisted.

We've just uploaded build 2.1.2.406 in the registered user area to fix this, and it should have taken care of your issue as well.


-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP


Posted By: Terry
Date Posted: 07 February 2005 at 9:46am

Thank you Roberto for the excellent support on this product.  I have uploaded the 406 release and am running with it now.  This is such a change from most software support groups and I really appreciate the work you all put into this great product.  Our employees are really happy to get rid of most of the spam too.

Stats since we installed spamfilterisp (this is what they don't get...)




Print Page | Close Window