Non-Delivery Report NOT Send when quarantine email
Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=6269
Printed Date: 16 July 2025 at 10:44am
Topic: Non-Delivery Report NOT Send when quarantine email
Posted By: support GLD
Subject: Non-Delivery Report NOT Send when quarantine email
Date Posted: 19 October 2007 at 10:14am
|
Hi We have a big problem !! With certains smtp server, when an e-mail is quarantined, the host smtp server don't receive NDR! This host re-sent this e-mail all hour for 5 days !!! If we disable quarantine, e-mails are delivered once With others Smtp servers : no problem. Smtp servers that we have problems are : smtpxx.msg.oleane.net (where xx are 1 to 99) and Ip's are (62.161.4.xx) (where xx are 1 to 99) ex : smtp24.msg.oleane.net = 62.161.4.24 Please help us !! SpamFilter version 3.5.4.718 Database SQL Server OS : W2k3 SP2 |
Replies:
Posted By: support GLD
Date Posted: 19 October 2007 at 10:30am
|
[server settings] ; dns - your DNS server dns=6.6.6.1,6.6.6.2 ; SpamFilter can be limited to listen on one or more specific IPs. Leave empty for all IPs, or separate multiple IPs with a comma "," ;ListenIP=209.26.140.2 ;or.... ;ListenIP=209.26.140.2,209.26.140.3 ListenFQDN=spam.<notredomain>.com ListenPort=25 ;The email address to use in Error Replies to senders ErrorHandlerEmailAddress="Spam System Administrator" <postmaster_no_reply@<notredomain>.com> ; DestinationServer is where you want all mail received by SpamFilter to be forwarded to DestinationServer= DestinationPort=25 ; AllowPercent is used to accept (AllowPercent=1) or reject (AllowPercent=0) emails containing the % character. ; Many SMTP servers are susceptible to being tricked into relaying with this. ; Ex. if you are netwide.net, then a spammer can use ; mail to: joe%yahoo.com@netwide.net ; to relay mail to joe@yahoo.com if your server is vulnerable ; Setting AllowPercent to 0 rejects ALL recipients email addresses conatining the % sign ;log daily activity to logfiles Logging=1 MultiThreaded=0 MaxInboundConnections=80 ;Set this to 1 if you want to disable EHLO extensions DisableEHLO=0 ;Any emails whose text portion exceeds this number of KB will not be scanned for keywords and Bayes ;Higher values *may* catch more spam but will cause higher load on processor MaxMsgSizeForKeywordScan=64 ;Set FilterBase64html to 1 if you want to block any emails with Content-Transfer-Encoding=base64 and Content-Type=text/html or text/plain FilterBase64html=0 ;Set RequireHELOBeforeMAILFROM to 0 if you do not want to require remote servers to issue a HELO or EHLO command before sending the email RequireHELOBeforeMAILFROM=0 ;Controls the minimum number of good and spam emails that must be received before the Bayesian filter kicks in MinEmailsForBayesKickIn=5000 ;by default SpamFilter will not allow any IP to relay thru it. Change DoNotTrustSelfByDefault to 1 if you want localhost to be able to relay DoNotTrustSelfByDefault=0 ;Remove any stale token in the corpus db.dat file that did not appear in incoming emails for the past n days CleanUpCorpusIntervalDays=7 ;Force disconnect of sessions after they have remained connected for this long IdleDisconnectMinutesTimeout=15 ;Force disconnect of sessions if a command has not been received within the last nn seconds ReadTimeout=60 ;Timeout when delivering emails to the destination SMTP server (in seconds) ReadTimeoutOutgoing=60 ;if turned on, this will cause tokens in incoming emails being logged to screen with relevant probabilities ShowBayesianTokens=0 ;Set TagSPAMAndQuarantine=1 if you want to prefix every quarantine subject line with the prefix specified in SPAMTagPrefix ini parameter TagSPAMAndQuarantine=1 ;This SPAMTagPrefix will be prefixed to all subject lines marked for "mark as SPAM and deliver" along with the ation specified by TagSPAMAndQuarantine SPAMTagPrefix=SPAM Probable: ;Setting DoNotSendNDROnQuarantine to 1 will prevent generation of NDR when email are quarantined by causing SpamFilter *not* to send an error code when quarantining emails DoNotSendNDROnQuarantine=0 ;If turned on, the threads that save to disk and load into memory the bayes corpus tokens will have increased priority BoostBayesPriority=1 ;if TrailingSQLSemiColon is set to 1 SpamFilter will add a ";" to the end of SQL statements. Disable only to help solve problems with some databases. TrailingSQLSemiColon=1 ;If turned on, any quarantined (false positives) emails that the end user force-delivers will cause the sender to be automatically whitelisted AutoWhiteListForceDeliveryEnabled=1 ;if EnableBadMailDir is set to 1, this will cause all emails that generate a "server error" when forwarded to your destination SMTP server will be saved in a "BadMailDir" for troubleshooting EnableBadMailDir=1 ;if ScanReceivedHeaders is set to 1 SpamFilter will add the "Received:" headers to the text examined for keywords and statistical Bayesian searches. ScanReceivedHeaders=1 ;if ScanAllHeaders is set to 1 SpamFilter will add all email's headers to the text examined for keywords and statistical Bayesian searches. ScanAllHeaders=0 ;Number of hours SpamFilter will retry to deliver messages in queue to your destination SMTP server if it was unreacheable. Enter 0 to try forever until back online. ExpireRetryQueueHours=0 ;Path to logfile directory LogFilePath=D:\SpamFilter\logfiles ;Optional destination SMTP server where to forward SPAM emails only. Good emails are still forwarded to main SMTP server DestSMTPServerForSPAM= ;The frequency in seconds for which the quarantine table is scanned to check for emails pending delivery - includes web-access password registration emails QuarantineToDeliverCheckInterval=5 ;By default the activity logfile is saved to disk every 60 seconds. Set RealtimeDiskLogging=1 to save the log every time it is updated RealtimeDiskLogging=0 ;Add any IPs (separated by commas - no wildcards) that you do not wish to be automatically added to the Honeypot IP blacklist. This setting also prevents those IPs to be added to the IP cache blacklist DoNotAddIPToHoneypot= ;An alternate server for sending NDR (non-delivery) notification emails can be used. Leave the "NotificationSMTPServer" value blank to use the default destination SMTP server NotificationSMTPServer=6.6.6.3 NotificationSMTPServerPort=26 ;NotificationSMTPServer= ;NotificationSMTPServerPort=25 ;Set EnableDbgLogs=1 to enable separate detailed logging for troubleshooting purposes EnableDbgLogs=0 ;The timeout in milliseconds for all DNS-related queries. DNSTimeout=15000 ;If an IP sends more than this number of spams in a certain period of time then it is temporarily banned (blacklisted) IPCacheLimboCountTrigger=3 ;If an IP sends more than a certain number of spams during this number of minutes then it is temporarily banned (blacklisted) IPCacheLimboTimeTrigger=10 ;If an IP address was banned because it sent too many spams in a certain time interval, it will be un-banned after this number of minutes IPCacheBlacklistDuration=60 ;You can force the antivirus plugin to block emails if they contain password protected archives that cannot be tested for viruses by setting this to 1 BlockArchivesWithPassword=0 ;By default SpamFilter will only perform DNS lookups when the reverse DNS filter is enable. Change value to 1 to always perform a reverse lookup on connecting IPs AlwaysDoReverseDNSLookups=0 ;Specifies how often the logfiles are rotated (Min=1, Max=24). The default is 24 (rotates at midnight). A value of 1 means every hour at the hour, value of 2 means at 2am, 4am, 6am etc... RotateLogsEveryNNhours=24 ;Change DoNotStartWithoutAV to 1 if you do not want SpamFilter to start/run if there is an error with the Antivirus plugin. DoNotStartWithoutAV=0 ;Determines if SpamFilter should hold in the queue emails that were rejected by the destination SMTP server with an error in the 4xy range QueueIfDestinationError400=0 ;Determines if SpamFilter should hold in the queue emails that were rejected by the destination SMTP server with an error in the 5xy range QueueIfDestinationError500=0 ;Determines if SpamFilter should remove from the queue emails that could not be delivered to the destination SMTP server due to a "Read Timeout" (an NDR is sent if the email is removed from the queue) DoNotQueueIfReadTimeout=0 ;Image filter threshold. Higher values indicate a more aggressive filter. 0 disables the filter. Min=0, Max=15 ;Image filter color sensitivity. Used internally to detect color shades SpamImageColorSensitivity=20 ;Images embedded in email's html having a width smaller than this will not be scanned. Useful to bypass signatures and logos SpamImageMinWidth=300 ;Images embedded in email's html having a height smaller than this will not be scanned. Useful to bypass signatures and logos SpamImageMinHeight=300 ;Determines the number of points that will be scanned in a image to process it for spam SpamImageSamplingPoints=200 ;to reduce false positives, emails with multiple inline images can bypass the image filter by setting this value to 1 SpamImagePassMultiImage=1 ;Specify the max number of pages a PDF document must contain in order to be scanned for spam signatures. The scan will be skipped altogether if there are more than this number of pages SpamPDFMaxPagesToScan=0 ;Specify the max number height in pixel of a PDF pages that will be scanned for spam signatures. To reduce false positives, pages taller than this will not be scanned SpamPDFMaxPixelHeight=1600 ;SpamFilter can block emails that contain only an empty, blank body and one of the following attachment. Clear the list if you don't want to stop such emails. Specify multiple attachments separated by commas BlockBlankEmailsWithAttachments=*.pdf,*.zip ;Set this to 0 to prevent queued emails to be spooled to memory, and force spooling to disk. While less efficient, spooling to disk helps allow existing antivirus software to detect and block some infected email files SpoolQueueFilesToMemory=1 ;If the private key of the SSL certificate is protected by a password, enter is here SSLCertificatePassword= ;Some older email clients have a bug that requires them to see "AUTH=LOGIN" in the EHLo response rather than "AUTH LOGIN". Set this to 1 to add the incorrect syntax to the EHLO output. Changes to this setting require SpamFilter to be restarted AddIncorrectAUTHLOGINEHLOEntry=1 ;Timeout in seconds used in the some SQL commands (Ex. inserting a new record in the tblQuarantine table) MiscSQLTimeout=1 ;SpamFilter Enterprise will delete temporary entries in the tblReloadTableInfo after they have been kept for this long. This parameter is used to allow multiple installations of SpamFilter Enterprise to maintain their settings in sync. It can be reduced to 5-10 seconds for installations running only one instance of SpamFilter Enterprise SecondsToHoldEntriesIntblReloadTableInfo=600 ;If the "AuthorizedTO" whitelist is used to specify the list of valid email addresses that can be accepted, by default SpamFilter will terminate a connection when the remote server specifies an invalid address in the RCPT TO command. You can use the following option to disable this forced disconnect, and cause SpamFilter to simply reject the invalid recipient, and continue to accept additional ones ForceDisconnectOnNonAuthorizedTO=false ;Use this option to prevent SpamFilter from performing the routine cleanup of the quarantine database by deleting old archived emails. Useful if admins want to perform their own cleanup DoNotDeleteExpiredEmailsFromQuarantine=0 ;SpamFilter is able to block blank emails that contain specific attachments. This parameter is used to specify the threshold of characters below which an email is considered blank MaxLettersToConsiderEmailBlank=4 LocalDomainsFilterMatrixFileName=D:\SpamFilter\AllowedDomainFilterMatrix.txt DestSMTPServerForSPAMPort=25 ListenIP= ListenPortSSL=0 ResponseWelcomeBanner=- Bienvenue sur le serveur Anti-Spam du Groupe LE DUFF - SpamFilter ISP %Ver% XServerHeader=LogSat Software SMTP Server du Groupe LE DUFF ccTLDsFileName=D:\SpamFilter\ccTLDs.txt ResolveDNSCache=0 EnableActivityLog=1 EnableIPCacheBlacklist=0 SFEActivationCode=rm3fkzT3H2N6CQmc/ozQ== PatchesURL=http://download.logsat.com/SpamFilter/pub/ LogKeywords=1 AutoVersionCheck=1 DisableConnectionsGrid=0 AddVirusSenderToHoneypot=0 RememberStats=1 MaxInboundConnectionsSameIP=30 MaxRCPTTO=15 MaxIncomingMsgSize=20248 FlushQueueInterval=10 VirusFoundAction=1 ArchiveSpamDays=4 DeleteExpiredEmailInterval=60 DBPatchesApplied= SFDB_URL=http://sfdb.logsat.com/SFDBUpload/ UserSelectEnterpriseVersion=0 DisconnectOnNonAuthorizedTO=0 MaxGridRecords=1000 BayesProbTrigger=170 EnableBayesianThread=0 ReceiveBodyIfNotInAuthTO=0 ADOConnectionString=FILE NAME=D:\AntiSpam\Database\SpamFilterMSSQL3.udl tblServersServerID=1 SPAMTagHeader=X-SF-SPAM:Y HideXSFWhiteListedReasonHeader=0 |
Posted By: LogSat
Date Posted: 19 October 2007 at 6:39pm
|
In your SpamFilter.ini file there should be another section similar to the following. Could you please post that as well? As a side-note, is the email actually spam,or is a valid email blocked by mistake? If it is spam, sometimes spammers will re-send the same email several times, ignoring the SMTP reject codes (or sometimes the same exact email is being sent from different zombie servers, appearing to originate from a single location). The email all end up in the quarantine however, so the end-user never sees them. [Error Response] ResponseBlacklistedMAPS=521 The IP %IP% is Blacklisted by %MAPSResponse%. ResponseBlacklistLocalIP=521 The domain %Domain% is Blacklisted. ResponseBlacklistLocalDomain=521 The domain %Domain% is Blacklisted. ResponseNoReverseDNS=550 Your IP %IP% does not have a reverse DNS entry. Disconnecting... ResponseMaxRCPTTO=550 You exceeded then maximum number of RCPT TO. Disconnecting... ResponseCountryBlacklist=550 Your IP address is from a blacklisted country. Disconnecting.. ResponseRelayRestricted=550 You are not allowed to send mail to %EMailTo% ResponseBlacklistLocalEMail=521 The EMail %EMailFrom% is Blacklisted. ResponseKeywordMatch=557 This email is rejected. It contains keywords rejected by the antispam content filter. ResponseBlacklistLocalEMailTo=521 The EMail %EMailTo% is Blacklisted. ResponseMaxIncomingMsgSize=552 This email is rejected. It exceeds the maximum allowed message size. ResponseNoMX=550 Your domain %Domain% does not have a valid MX DNS record. Disconnecting... ResponseBlacklistedSURBL=521 A URL in the email is Blacklisted by SURBL: %MAPSResponse%. ResponseVirusFound=557 This email is rejected because it contains a virus ResponseSPF=550 The sender did not meet Sender Policy Framework rules. Please see http://spf.pobox.com ResponseIPCacheBlacklist=421 Your IP is temporarily blocked, please try again later. ResponseSpamImage=557 This email is rejected. It contains content rejected by the antispam filter. ResponseSFDB=557 Your IP %IP% is currently listed in SpamFilter ISP's Distributed Blacklist. Please see http://www.logsat.com/SFDB/why.asp for details. ResponseEmptyMAILFROM=521 Emails with an empty MAIL FROM are not allowed ResponseNotInAuthorizedTO=557 You are not allowed to send mail to %EMailTo% ResponseHoneypotMatch=521 The IP %IP% is Blacklisted. ------------- Roberto Franceschetti http://www.logsat.com" rel="nofollow - LogSat Software http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP |
Posted By: support GLD
Date Posted: 22 October 2007 at 3:46am
 Thank you !! Very much !!I have changed errors response and forgot to insert codes errors at the beginning of the line !!!
Thank You !!! |