I have 3 questions - ORF Forums

I have 3 questions RSS Back to forum


1. How do I set a block for the entire zone? For example, I want to block all domains ending in .cam
2. Why do addresses added to the Sender Whitelist continue to be blocked by the SPF Test filter? I have to add addresses both ways. This is quite inconvenient!
3. Is it possible to click on the "this is spam" button in Microsoft Outlook and tell ORF that this is spam?

by Sub-Zero 3 months ago

@Sub-Zero: Hello Sub-Zero,

Please find the answers to your questions below:

I recommend adding a regex-type filter expression to the "Blacklists > Sender Blacklist" test with the following regex pattern:


If you want to block multiple top-level domains, list them in capture group "(...)", separating them with the "|" pipe character:


On the "Whitelist > Sender Whitelist" page, remove the checkmark from the "Validate the sender before whitelisting..." option (disabled by default).

In "Whitelisted Test Exceptions" dialog (Filtering > Tests > Configure button), make sure the "SPF Test" is disabled (disabled by default).

That being said, if you have a problem with a specific sender only, you should consider adding the problematic email address or domain to the SPF "Sender Email Exceptions" list (Blacklists > SPF Test > Settings> Exceptions).

No, the "this is spam" button in Outlook is not connected to the ORF service.

If you are having issues with spam, consider sending us your ORF configuration file and a few recent old logs for a review:

- The configuration file is called "orfent.ini", and it can be found in the ORF program directory (C:\ProgramData\ORF Fusion).

- ORF logs have a .log extension (e.g. orfee-2021-06-09.log) and can be found on the configured ORF logging path (default: C:\ProgramData\ORF Fusion\TextLogs).

I hope the above proves helpful to you, but let me know if you have further questions.

by Daniel Novak (Vamsoft) 3 months ago
(in reply to this post)


@Sub-Zero: An additional note to your second question:

The email address you see in the "Sender" column of the ORF logs is called the "envelope sender" address (aka. smtp.MAILFROM address). This is the email address that is actually used by the "Sender Whitelist" and "SPF Test", and it can be different from the "author address" which is displayed in the "From:" field when you open the email in Outlook, or in any other mail client.

If you want to create a filter based on the "author address", you will need to create a regex-type "Keyword Blacklist" filter expression with a "Header field [From]" search scope, using the same regex expression I provided in my post above (Blacklists > Keyword Blacklist > New).

To learn more about this topic, I suggest you read the "Still receiving emails spoofing your domain" section of the following article: https://vamsoft.com/support/docs/articles/how-to-blacklist-self-spam#sender-addr

by Daniel Novak (Vamsoft) 3 months ago
(in reply to this post)

New comment

Fill in the form below to add a new comment. All fields are required. If you are a registered user on our site, please sign in first.

It will not be published.
hnp1 | hnp2