Introduction

The Auto Sender Whitelist test of ORF monitors the outgoing email flow and records the addresses your local users send emails to in a database. When they reply back, ORF checks this database, and if the sender has been emailed before by your local users, the reply will be whitelisted (excluded from blacklist tests). This mechanism helps to ensure that no legitimate email will be classified as spam by ORF.

In some rare cases the database gets polluted by addresses which should not be whitelisted (e.g., the user accidentally replies to a spam), resulting in degraded spam filtering performance.

Solutions

Adding the address to the check exceptions

The quickest and easiest way is adding the address which should not be whitelisted to the exception list, so ORF will ignore it. To do this:

1. Start the Administration Tool and connect to the local (or remote) ORF installation
2. Navigate to the Whitelists / Auto Sender Whitelist page
3. Click the Settings button
4. Select the Check exceptions tab and click the Edit List... button
5. Click the New button and enter the email address to be excluded
6. Press OK three times
7. Save your settings to apply the changes by pressing Ctrl + S

The email address will remain in the database but will be ignored permanently, and it will expire eventually.

Removing the address from the database

Alternatively, you can remove the related entry from the database itself, but that is possible only if you use an external SQL database (Private Local Databases cannot be edited). Moreover, the address can end up in the whitelist again anytime a user sends another email to it accidentally, so we recommend using the above described method instead.

Preventing Auto Sender Whitelist database pollutions

ORF is able to detect automatic replies in many ways to ensure they do not cause accidental automatic whitelistings. Use these options whenever possible. We also recommend adding your own domain(s) to the exception list as described above (using a wildcard like *@mydomain.com), as spammers tend to spoof the recipient address in the sender address field.