• | MAPS Blacklist servers - SpamFilter checks the IP address initiating the connection. If it is listed in one of its many DNS blacklists the connection is refused. SpamFilter can reject connections based on a configurable minimum number of matches. A ",true" after an RBL entry means their DNS is expecting the IP to be reversed, i.e. to test a connection from 1.2.3.4 they expect 4.3.2.1.bl.spamcop.net |
• | SURBL Blacklist servers - SpamFilter scans the content of emails for any HTTP links and URLs. Every link found is then tested against one of the many SURBL DNS blacklists available. If present, the connection is refused. |
• | Blacklisted IPs - You can keep a file with additional IPs that you want to blacklist by entering the filename below. If the file does not exist it will be created. The file is reloaded every minute. List individual IP addresses on each line. Use an ending .0 for a Class C wildcard (i.e. 192.12.45.0 to block 192.12.45.1 --> 192.12.45.255, or 192.12.0.0 to block 192.12.0.0 --> 192.12.255.255). This IP blacklist also supports the use of CDIR notation to specify networks. For example, 192.12.45.0/24 will block the previous Class C of addresses as well. The contents of the file will be loaded in the memo box, allowing you to make changes to the file. |
• | Blacklisted Domains - You can keep a file with additional Domains that you want to blacklist (based on the MAIL FROM field) by entering them below. Enter one domain per line, wildcards (* and ?, same rules as DOS wildcards) are allowed. You can also use Regular Expressions (RegEx). If the file does not exist it will be created. The file is reloaded every minute. The contents of the file will be loaded in the memo box, allowing you to make changes to the file. |
o | This list supports the :NULL option to send emails in a black hole. If an entry is in the form domain1.com:NULL it will cause all emails from domain1.com to be accepted and then sent to NULL right away. Such emails will not cause NDRs, they will not be quarantined, they will not be seen by the users. |
o | If an entry is in the form domain1.com:NoNDR such emails will not cause NDRs as in the DoNotSendNDROnQuarantine parameter in the ini file. |
o | This list supports the :Honeypot option, which will cause the sender's IP address to be automatically blacklisted in the future. |
• | Blacklisted FROM Emails - If you want to block any particular email addresses, enter them here, one email per line. Wildcards (* and ?, same rules as DOS wildcards) are allowed. You can also use Regular Expressions (RegEx). |
o | This list supports the :NULL option to send emails in a black hole. If an entry is in the form user1@domain1.com:NULL it will cause all emails from user1@domain1.com to be accepted and then sent to NULL right away. Such emails will not cause NDRs, they will not be quarantined, they will not be seen by the users. |
o | If an entry is in the form domain1.com:NoNDR such emails will not cause NDRs as in the DoNotSendNDROnQuarantine parameter in the ini file. |
o | This list supports the :Honeypot option, which will cause the sender's IP address to be automatically blacklisted in the future. |
• | Blacklisted TO Emails - If you want to block any particular destination addresses, enter them here, one email per line. Wildcards (* and ?, same rules as DOS wildcards) are allowed. You can also use Regular Expressions (RegEx). |
o | If an entry is in the form user1@domain1.com:NULL it will cause all emails to user1@domain1.com to be accepted and then sent to NULL right away. Such emails will not cause NDRs, they will not be quarantined, they will not be seen by the users. |
o | If an entry is in the form domain1.com:NoNDR such emails will not cause NDRs as in the DoNotSendNDROnQuarantine parameter in the ini file. |
o | This list supports the :Honeypot option, which will cause the sender's IP address to be automatically blacklisted in the future. |
• | Country Filters - SpamFilter checks the what country incoming connections are coming from. The current number of connections for each country can be updated by clicking on the Update Stats Now button. Columns can be sorted by clicking on the column header. This will help you in sorting countries and hits so you can determine if there are any countries you do not wish to receive email from. |
• | Honeypot Emails - You can have a list of "honeypot" email addresses. Any email sent to an address in the list will cause the sender's IP to be blacklisted. The IP address will be added to the file HoneypotBlockedIPs.txt, which contains the list of blocked IPs automatically added by this filter. This filter is typically used by adding non-existent email accounts to it that you know should never receive mail. If they do, then the email is likely spam, so the remote IP will be blacklisted automatically. |
• | Attachment Blocking - You can block emails that have unwanted attachments. You can keep a file with banned attachments here. check emails for specific attachments or attachment extensions. If the attachment is found, the email is rejected. Wildcards (* and ?, same rules as DOS wildcards) are allowed. You can also use Regular Expressions (RegEx). |
o | This list supports the :NULL option to send emails in a black hole. If an entry is in the form filename:NULL it will cause all emails with the filename attachment to be accepted and then sent to NULL right away. Such emails will not cause NDRs, they will not be quarantined, they will not be seen by the users. |
o | If an entry is in the form domain1.com:NoNDR such emails will not cause NDRs as in the DoNotSendNDROnQuarantine parameter in the ini file. |
o | This list supports the :Honeypot option, which will cause the sender's IP address to be automatically blacklisted in the future. |
• | Keywords Filter - You can check email content and subject header for specific keyword and/or phrases. If found, the email is rejected. You can also use Regular Expressions (RegEx). If the keyword file does not exist it will be created. The file is reloaded every minute. The contents of the file will be loaded in the memo box, allowing you to make changes to the file. |
• | This list supports the ::NULL option to send emails in a black hole. |
• | If an entry is in the form keyword::NULL it will cause all emails to be accepted and then sent to NULL right away. Such emails will not cause NDRs, they will not be quarantined, they will not be seen by the users. |
• | If an entry is in the form keyword::NoNDR such emails will not cause NDRs as in the DoNotSendNDROnQuarantine parameter in the ini file. |
• | This list supports the ::Honeypot option, which will cause the sender's IP address to be automatically blacklisted in the future. |
• | This list supports the ::NEGATE suffix in blacklist keywords. Adding this suffix causes a MATCH if the keyword is NOT present, or causes a MISMATCH if the keyword IS present. |
Please note that unlike in other cases, with the keyword list you must enter the ":" symbol twice to specify the extra tag.
The keyword list allows to specify multiple RegEx expressions separated by commas, just as regular keywords can be separated by commas. This has the effect of specifying "AND" rules for RegEx. Note that a "Standard non-RegEx keyword must be specified first for SpamFilter to recognize this syntax. For example: X-SF,([a-z]), ([0-9])
The keyword rules are as follows:
▪ | Keyword(s) are entered on separate lines |
▪ | If all keyword(s) on a single line are found in the message, it is then rejected. |
▪ | Separate keywords on a single line by using commas. |
▪ | The subject of an email can be scanned for keywords by prefixing the keyword list with Subject: |
▪ | The contents of the "From:" header of an email (which usually includes a name and an email address) can be scanned for keywords by prefixing the keyword list with EmailFrom: |
▪ | The contents of the "To:" header of an email (which usually includes one or more names and email addresses) can be scanned for keywords by prefixing the keyword list with EmailTo: |
▪ | The complete set of headers of an email can be scanned for keywords by prefixing the keyword list with Headers: |
Sample keyword entries:
|
Sample email content and effects:
|
▪ | mortgage,click here,mailing |
|
.... low mortgage, click here to be removed from our mailing ...
|
rejected
|
matches all keywords in 1st line
|
.... low mortgage, click over here to be removed from our mailing ...
|
accepted
|
click over here is no match for click here
|
.... low mortgage, click over here to unsubscribe from our mailing ...
|
rejected
|
matches single keyword on 3rd line
|
|