Byteplant Forum

Home » CleanMail Support » CleanMail Server Talk » Strange *SPAM* markers, NST 3.0.5.1
Strange *SPAM* markers, NST 3.0.5.1 [message #1875] Wed, 12 December 2007 12:15
SitePointCKO
Messages: 3
Registered: December 2007
Junior Member
Hi folks,

i've got some strange behaviour since the last update of NST server. (Current Version: 3.0.5.1)

In our filter array we use a spam assassin filter as "last step". In this filter we include "[SPAM?]" in the header, if a specific score is reached.

Since the last update a lot of mails are marked with "*SPAM*" and we don't use this tag. It seems, that some filter tags the mails by itself without any posibility to change the settings in the GUI of NST.

Another problem is the "feature", that the the whitelist is ignored by the new versions DNSBL-Filter. We have a lot of trouble with this, because we use the whitelisting exactly for the purpose of bypassing DNSBL-Entry-related false positives.

Is there some posibility of change that behaviour by editing some config file?

Thanks in advance,

Chris

Re: Strange *SPAM* markers, NST 3.0.5.1 [message #1876 is a reply to message #1875] Wed, 12 December 2007 16:32 Go to previous message
support
Messages: 918
Registered: April 2004
Senior Member
> i've got some strange behaviour since the last update of NST
> server. (Current Version: 3.0.5.1)
>
> In our filter array we use a spam assassin filter as "last
> step". In this filter we include "[SPAM?]" in the header, if a
> specific score is reached.
>
> Since the last update a lot of mails are marked with "*SPAM*"
> and we don't use this tag. It seems, that some filter tags the
> mails by itself without any posibility to change the settings
> in the GUI of NST.

Since NST V3.0.5.1, the Attachment/Blacklist/DNSBL filters support filter specific tagging with "* SPAM *" as default. The tags can of course be changed in the NST Admin Wizard.

> Another problem is the "feature", that the the whitelist is
> ignored by the new versions DNSBL-Filter. We have a lot of
> trouble with this, because we use the whitelisting exactly for
> the purpose of bypassing DNSBL-Entry-related false positives.
>
> Is there some posibility of change that behaviour by editing
> some config file?

Since NST V3.0.5.1, the Attachment and AntiVirus filters by default ignore the whitelist. This is to maximize email security: consider a whitelisted sender that falls victim to a virus and starts to spread it.
To have the same behaviour as in pre-3.0.5.1 versions, please add a
IgnoreWhitelist="false"
line to the
[ServerSessionManager\Ports\SMTPPort\Filters\AttachmentConfig]
and
[ServerSessionManager\Ports\SMTPPort\Filters\AntiVirusConfig]
sections of your nospamtoday.cf file.



Customer Support
Byteplant GmbH
Re: Strange *SPAM* markers, NST 3.0.5.1 [message #1877 is a reply to message #1876] Wed, 12 December 2007 17:28 Go to previous message
SitePointCKO
Messages: 3
Registered: December 2007
Junior Member
Thanks for the fast relpy.

Unfortunately, the problem is not solved:

>Since NST V3.0.5.1, the Attachment/Blacklist/DNSBL filters support filter specific >tagging with "* SPAM *" as default. The tags can of course be changed in the NST >Admin Wizard.

My DNSBL/Blacklist - Setting is "reject/delete", so that cannot be the source of the tagging.

>To have the same behaviour as in pre-3.0.5.1 versions, please add a
>IgnoreWhitelist="false"
>line to the
>[ServerSessionManager\Ports\SMTPPort\Filters\AttachmentConfig]
>and
>[ServerSessionManager\Ports\SMTPPort\Filters\AntiVirusConfig]
>sections of your nospamtoday.cf file.

I added IgnoreWhitelist="false" to the sections
[ServerSessionManager\Ports\SMTPPort\Filters\AttachmentConfig]
and
tried to Add it to
[ServerSessionManager\Ports\SMTPPort\Filters\DNSBLConfig]

In [ServerSessionManager\Ports\SMTPPort\Filters\DNSBLConfig] it seems to get ignored (Not shown in Log).

But the problem stays. For example, it happens, if i get mails from glengamoi.com - mailing list (you guys support them Smile ) and if i take a look at the log, i get no hint how this happens.

Some example from log file:

From: XXXXXXXXXXXXXX@glengamoi.com
Dec 11, 2007, 10:41:42 Session 2: To: XXXXXXXXX@sitepoint.de
Dec 11, 2007, 10:41:42 Session 2: Subject: =?iso-8859-1?Q?[Coffeehouse] OT: Auch K=E4nguruhs relaxen?=
Dec 11, 2007, 10:41:42 Session 2: (Blacklist) Filter result is accept/deliver
Dec 11, 2007, 10:41:42 Session 2: (Whitelist) Filter result is accept/deliver (whitelisted)
Dec 11, 2007, 10:41:42 Session 2: (DNSBL Filter) Filter result is accept/deliver (not filtered)
Dec 11, 2007, 10:41:42 Session 2: (Spam Trap) Filter result is accept/deliver (not filtered)
Dec 11, 2007, 10:41:42 Session 2: (Delay Filter) Filter result is accept/deliver (not filtered)
Dec 11, 2007, 10:41:42 Session 2: (SpamAssassin) Filter result is accept/deliver (not filtered)
Dec 11, 2007, 10:41:42 Session 2: Received end of data, mail size 2kB
Dec 11, 2007, 10:41:42 Session 2: (Attachment Filter) Filter result is accept/deliver
Dec 11, 2007, 10:41:43 Session 2: Incoming mail action: accept/deliver (whitelisted)
Dec 11, 2007, 10:41:44 Session 2: Connection closed by client

This should result in a normal delivery, but the subject i recieve is tagged with "* SPAM *" and i have no clue, how this happens.

Before you ask: I have no client-side software running on my pc, there's no other filtering software after the NST processing of the mails.

And: It began to happen with 3.0.5.1.

Thanks in advance,

Chris

Re: Strange *SPAM* markers, NST 3.0.5.1 [message #1878 is a reply to message #1877] Wed, 12 December 2007 19:42 Go to previous message
support
Messages: 918
Registered: April 2004
Senior Member
> Thanks for the fast relpy.
>
> Unfortunately, the problem is not solved:
>
> >Since NST V3.0.5.1, the Attachment/Blacklist/DNSBL filters
> support filter specific >tagging with "* SPAM *" as default.
> The tags can of course be changed in the NST >Admin Wizard.
>
> My DNSBL/Blacklist - Setting is "reject/delete", so that cannot
> be the source of the tagging.
>
> >To have the same behaviour as in pre-3.0.5.1 versions, please
> add a
> >IgnoreWhitelist="false"
> >line to the
> >[ServerSessionManager\Ports\SMTPPort\Filters\AttachmentConfig]
> >and
> >[ServerSessionManager\Ports\SMTPPort\Filters\AntiVirusConfig]
> >sections of your nospamtoday.cf file.
>
> I added IgnoreWhitelist="false" to the sections
> [ServerSessionManager\Ports\SMTPPort\Filters\AttachmentConfig]
> and
> tried to Add it to
> [ServerSessionManager\Ports\SMTPPort\Filters\DNSBLConfig]
>
> In [ServerSessionManager\Ports\SMTPPort\Filters\DNSBLConfig]
> it seems to get ignored (Not shown in Log).

This works only for Attachment/AntiVirus filters.

> Dec 11, 2007, 10:41:42 Session 2: (Blacklist) Filter result is
> accept/deliver
> Dec 11, 2007, 10:41:42 Session 2: (Whitelist) Filter result is
> accept/deliver (whitelisted)
> Dec 11, 2007, 10:41:42 Session 2: (DNSBL Filter) Filter result
> is accept/deliver (not filtered)
> Dec 11, 2007, 10:41:42 Session 2: (Spam Trap) Filter result is
> accept/deliver (not filtered)
> Dec 11, 2007, 10:41:42 Session 2: (Delay Filter) Filter result
> is accept/deliver (not filtered)
> Dec 11, 2007, 10:41:42 Session 2: (SpamAssassin) Filter result
> is accept/deliver (not filtered)
> Dec 11, 2007, 10:41:42 Session 2: Received end of data, mail
> size 2kB
> Dec 11, 2007, 10:41:42 Session 2: (Attachment Filter) Filter
> result is accept/deliver
> Dec 11, 2007, 10:41:43 Session 2: Incoming mail action:
> accept/deliver (whitelisted)
> Dec 11, 2007, 10:41:44 Session 2: Connection closed by client
>
> This should result in a normal delivery, but the subject i
> recieve is tagged with "* SPAM *" and i have no clue, how this
> happens.

There was an issue with whitelisted emails that matches what you describe. It has already been resolved in the currently available download of V3.0.5.1. Please do a fresh download and install it on top of your existing NST installation.



Customer Support
Byteplant GmbH
Re: Strange *SPAM* markers, NST 3.0.5.1 [message #1879 is a reply to message #1878] Thu, 13 December 2007 09:38 Go to previous message
SitePointCKO
Messages: 3
Registered: December 2007
Junior Member

> There was an issue with whitelisted emails that matches what
> you describe. It has already been resolved in the currently
> available download of V3.0.5.1. Please do a fresh download and
> install it on top of your existing NST installation.

Okay, i updated with a fresh download and same version.

Now it's fixed.

Thanks.
Previous Topic: MIME Violations
Next Topic: 501 invalid email address
Goto Forum:
  


Current Time: Wed Sep 28 02:01:54 CEST 2016