keyword blacklist failing RSS Back to forum
@mark rosenbaum:
If you are referring to the Configuration / Tests / Tests page: please note that since the email body is not yet available at the Before Arrival stage (RCPT TO: command in the SMTP transport), the Keyword Blacklist test can be performed at the On Arrival filtering point only, where the entire email is at the disposal of ORF. The same applies to the Attachment filtering, Keyword Whitelist, Charset Blacklist, and External Agent tests: these all rely on information available at On Arrival only.
That is why the filtering point assignment of these tests cannot be edited, hence the greyed our radio button. The enabled/disabled state of these tests are affected only by the status of the checkbox in the "Enabled" column:
http://bit.ly/z93tRK
If the checkbox of the Keyword Blacklist test is enabled it should run. Is it not possible that some other test whitelisted the email? You can verify this by checking the related entries in the ORF Log Viewer (http://blog.vamsoft.com/2010/04/21/using-the-orf-log-viewer/)
If the email was not whitelisted: please send us your current configuration file called orfent.ini and the email which passed through filtering (in EML format with the original MIME headers) to . Also, please tell us which keyword entry should have blocked it, so we can run some tests.
Now running exchange 2010.
When I look at tests and check keyword blacklist it is still greyed out(radial button).
I imported keyword blacklist from my exchange 2003 server that I decomisssioned. Using orf 4.4 on both servers.
Getting spam with words that are listed in the keyword blacklist.