I have 3 questions - ORF Forums

@Sub-Zero: Hello Sub-Zero,

Please find the answers to your questions below:

1)
I recommend adding a regex-type filter expression to the "Blacklists > Sender Blacklist" test with the following regex pattern:

.*\.cam$

If you want to block multiple top-level domains, list them in capture group "(...)", separating them with the "|" pipe character:

.*\.(cam|ninja|win|xxx|etc)$

2)
On the "Whitelist > Sender Whitelist" page, remove the checkmark from the "Validate the sender before whitelisting..." option (disabled by default).

In "Whitelisted Test Exceptions" dialog (Filtering > Tests > Configure button), make sure the "SPF Test" is disabled (disabled by default).

That being said, if you have a problem with a specific sender only, you should consider adding the problematic email address or domain to the SPF "Sender Email Exceptions" list (Blacklists > SPF Test > Settings> Exceptions).

3)
No, the "this is spam" button in Outlook is not connected to the ORF service.

If you are having issues with spam, consider sending us your ORF configuration file and a few recent old logs for a review:

- The configuration file is called "orfent.ini", and it can be found in the ORF program directory (C:\ProgramData\ORF Fusion).

- ORF logs have a .log extension (e.g. orfee-2021-06-09.log) and can be found on the configured ORF logging path (default: C:\ProgramData\ORF Fusion\TextLogs).

I hope the above proves helpful to you, but let me know if you have further questions.

@Sub-Zero: An additional note to your second question:

The email address you see in the "Sender" column of the ORF logs is called the "envelope sender" address (aka. smtp.MAILFROM address). This is the email address that is actually used by the "Sender Whitelist" and "SPF Test", and it can be different from the "author address" which is displayed in the "From:" field when you open the email in Outlook, or in any other mail client.

If you want to create a filter based on the "author address", you will need to create a regex-type "Keyword Blacklist" filter expression with a "Header field [From]" search scope, using the same regex expression I provided in my post above (Blacklists > Keyword Blacklist > New).

To learn more about this topic, I suggest you read the "Still receiving emails spoofing your domain" section of the following article: https://vamsoft.com/support/docs/articles/how-to-blacklist-self-spam#sender-addr