Forums  Register  Login  My Profile  Inbox  Address Book  My Subscription  My Forums 

Member List  Search  FAQ  Ticket List  Log Out

 

RE: NDR spam

 
Logged in as: Guest
Users viewing this topic: none
  Printable Version
All Forums >> [Web & Mail Security] >> GFI MailEssentials >> RE: NDR spam Page: <<   < prev  1 [2]
Login
Message << Older Topic   Newer Topic >>
RE: NDR spam - 23.Oct.2009 7:29:05 PM   
RSP

 

Posts: 1270
Joined: 31.Oct.2006
From: The East Riding of Yorkshire, UK
Status: offline
If it's caught by a filter, the log would only show that filter with a non-zero result code and the previous filters. However, it's the New Senders module that does an extra test on NDRs, not the whitelist. New Senders will only perform this check when NDRspamnewsenders is set to 1 or not present.

If the NDRspamallowsamedomain is set to 1 or not present, then an NDR purporting to be from ANY domain your users have emailed will be allowed through.

If the ase_scandsn is set to 1, NDRs will be scanned by all modules, so any module could theoretically catch it.

This is how I understand it.

What do you mean by 'Odd they say what the default is, but it appears to not be functioning correctly'? Do you mean that if the values are not present they appear to default to 0? If so, it's a bug!

_____________________________

Disclaimer: I don't work for GFI, I just use their products.

(in reply to icccapital)
Post #: 16
RE: NDR spam - 26.Oct.2009 2:20:13 PM   
icccapital

 

Posts: 36
Joined: 4.May2006
Status: offline
Sorry, no that wasn't clear.  I meant that I did not add those keys to the registry, but when I went to look they were both there and they were both set to 0.  That seemed odd considering the default when they aren't there is assumed 1, so why would the install not only add them but set them to 0.

(in reply to RSP)
Post #: 17
RE: NDR spam - 26.Oct.2009 3:10:13 PM   
RSP

 

Posts: 1270
Joined: 31.Oct.2006
From: The East Riding of Yorkshire, UK
Status: offline
GFI have probably made an internal change, possibly by accident, and/or failed to update the KB.

_____________________________

Disclaimer: I don't work for GFI, I just use their products.

(in reply to icccapital)
Post #: 18
RE: NDR spam - 28.Oct.2009 7:00:55 AM   
icccapital

 

Posts: 36
Joined: 4.May2006
Status: offline
Thanks for all the help.  I think i am going to open a case on this one because the emails continue to flow for this user.

(in reply to RSP)
Post #: 19
Page:   <<   < prev  1 [2]
All Forums >> [Web & Mail Security] >> GFI MailEssentials >> RE: NDR spam Page: <<   < prev  1 [2]
Jump to:





New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts