embeded GIF rejected, attached is not , domain whitelisted but still rejected - ORF Forums

embeded GIF rejected, attached is not , domain whitelisted but still rejected RSS Back to forum

1

Hi,

I'm running ORF 4.3 on a simple windows 2003 simple smtp service to filter mail before its exchange 2007.

Have isolated a problem of rejected email down to a particulate 43kb GIF that is embedded in an HTML formated email.

Sending the GIF as an attachment works, sending it embeded is rejected.

I can recreate easily from GMAIL by simply drag and drop (to embed as opposed to attach) the gif from my windows DIR into the Gmail web app an sending to the appropriate email address.

Eamil is then returned to Gmail with 5.7.1.

Looking at the smtp logs is can see no indication of rejection:


2012/02/07 11:43:06 209.85.210.194 mail-iy0-f194.google.com SMTPSVC1 192.168.2.3 0 EHLO - +mail-iy0-f194.google.com 250 0 187 29 0 SMTP

2012/02/07 11:43:06 209.85.210.194 mail-iy0-f194.google.com SMTPSVC1 192.168.2.3 0 MAIL - +FROM: 250 0 52 39 0 SMTP

2012/02/07 11:43:06 209.85.210.194 mail-iy0-f194.google.com SMTPSVC1 192.168.2.3 0 RCPT - +TO: 250 0 36 33 15 SMTP

2012/02/07 11:43:31 209.85.210.194 mail-iy0-f194.google.com SMTPSVC1 192.168.2.3 0 DATA - + 250 0 75 64039 24344 SMTP

2012/02/07 11:43:31 209.85.210.194 mail-iy0-f194.google.com SMTPSVC1 192.168.2.3 0 QUIT - mail-iy0-f194.google.com 240 25391 56 4 0 SMTP

I have also added the domain to the sender WHITELIST.

So I know why the email is bounced , but i dont know exactly what software or setting is boucing it ?

Why does adding to the WHITELIST not resolve ?

Thanks
Scott




by Scott Edgar 7 years ago
2

@Scott Edgar: What does the ORF log show regarding this particular email? (http://blog.vamsoft.com/2010/04/21/using-the-orf-log-viewer/)

by Krisztian Fekete (Vamsoft) 7 years ago
(in reply to this post)

3

@Krisztian Fekete (Vamsoft): Thank you for the email, great help , had completely forgotten these logs existed.

SMTPSVC-1 2012-02-07T11:43:31 Blacklist Info Reject OnArrival 209.85.210.194 TEST10 Email blacklisted. Agent "Vamsoft Image Spam Agent" hit (exit code 85). Agent output: "Image spam probability is 85%.".

So how should i deal with this ?

Kind regards
Scott

by Scott Edgar 7 years ago
(in reply to this post)

4

@Scott Edgar: This appears to be a false positive with the Image Spam Agent. This agent uses heuristics to detect and blacklist image spam. As the image spam phenomenon is a lot less provident today than it used to be when the agent was written, I recommend disabling the agent entirely. You can disable the agent under Configuration / Filtering - On Arrival in the ORF Administration Tool.

by Peter Karsai (ORF Team) 7 years ago
(in reply to this post)

5

Thank you , me re creatable test case has been resolved. Many thanks for the advice.

by Scott Edgar 7 years ago
6

@Scott Edgar: Thank you for the update, I am glad to hear it helped. In case you are receiving increased amount of spam due to the disabled agent, please let us know and we will be happy to review your logs and configuration for fine-tuning tips.

by Peter Karsai (ORF Team) 7 years ago
(in reply to this post)

New comment

Fill in the form below to add a new comment. All fields are required. If you are a registered user on our site, please sign in first.

It will not be published.
hnp1 | hnp2