Phone Lines icon GFI Support

Articles in this section

See more

How to determine why an email was whitelisted by GFI MailEssentials

Author: Luis Fernandes Updated

Answer

When an email is whitelisted, it will appear in the MailEssentials Dashboard > Logs tab as 'Whitelisted' or 'Keyword Whitelisted'.

Required Information:

Sample Email Message ID: This can be gathered from the headers of the email or via the Dashboard > Logs > Details tab.
 
Log files from  ..\GFI\MailEssentials\AntiSpam\Debug Logs. The four log files are as follows:
  • ase_ipwhitelist.gfi_log
  • ase_kwhite.gfi_log
  • ase_personalwhitelist.gfi_log
  • ase_whitelist.gfi_log
NOTE: You may also need to check the .bak files depending on how old the sample is.
 
Checking the IP Whitelist
  1. Open the ase_ipwhitelist.gfi_log file in notepad
  2. This log is for the IP Whitelist and corresponds to the Configuration > Anti-Spam > Whitelist > IP Whitelist tab in the interface and the ipwhitelist table within the config.mdb
  3. Search for the Message ID of the sample
  4. You will get something similar to the example below:
">> Init Message [<mysamplemessageid@domain.com>]"
"Context Refreshed: No"
"Licensing check: Licensed"
"<< Message Initialization"
">> Message Processing Block"
"Connecting IP: 192.3.158.73"
"CIPWhitelist::Execute()"
"Checking address [192.3.158.73]"
"Address [192.3.158.73] is not whitelisted"
"Message is not whitelisted ... "
  • The bolded lines are the important ones in this log file
  • The Connecting IP is the IP address of the sending server
  • This IP was not in the whitelist
  • If the IP address matches, you will instead seem something similar to this:
"Checking address [192.168.4.134]"
"Address [192.168.4.134] is whitelisted"
"Message is whitelisted ... "
"Setting block report to [IP is in Whitelist]"
 
Checking the Keyword Whitelist:
  1. Open the ase_kwhite.gfi_log file in notepad
  2. This log is for the Keyword Whitelist and messages will appear in the dashboard as 'Keyword Whitelisted'. It corresponds to Configuration > Anti-Spam > Whitelist > Keyword Whitelist in the interface and the kwhitebody and kwhitesubject tables in the config.mdb.
  3. Search for the Message ID of the sample
  4. You will get something similar to the below:
"Scanning subject ..."
"Scanning message body (TEXT)"
"Scanning body ..."
"Found 1 words: [access]"
"Setting actions data ..."
"Informing ASE of whitelisting [2]..."
"Whitelisted because of following keywords: 'access'"
"Setting block report to [Found word(s) 'access' in message body]"
  • Here the imported lines are again bolded
  • The check if the subject yielded no matches
  • The check if the body yielded a single match
  • The matched word was 'access'
  • If a message is not whitelisted by the Keyword Whitelist, the logging ends with the following:
"<< Message Processing Block"
">> Message Uninitialization"
"<< Message Uninitialization"
 
Checking the Personal Whitelists: 
  1. Open the ase_personalwhitelist.gfi_log  file in notepad
  2. This file contains information on the personal whitelists and is quickly overwritten. It corresponds to the Configuration > Anti-Spam > Whitelist > Personal Whitelist in the interface and the PWLBL.sdf table in the database.
  3. Perform a search for your message ID
  4. You will get something similar to ones the below:
"Checking message against Personal Whitelist"
"SMTP Recipient [gfitest@gfi.com] does not care"
  • The bolded line is the important one. This sender was not on the personal whitelist.
"Checking message against Personal Whitelist"
"SMTP Recipient [gfitest@gfi.com] ACCEPTS message"
"Injecting actioning data since some users blocked/accepted the message ..."
"All recipients allowed sender, setting GFI_ASEMSGPROPS_WHITELISTED property with updated details ..."
  • Again, the important line is bolded.  This sender was on gfitest@gfi.com's personal whitelist.
Note: A separate line will be logged for each user checked.
 
Checking the Autowhitelist and the Email/Domain Whitelist:
  1. Open the ase_whitelist.gfi_log file
  2. This log contains the autowhitelist and the whitelist modules and is the most complicated to read. It corresponds to the Configuration > Anti-Spam > Whitelist > Whitelist and AutoWhiteList tabs and the antispam2_whitelist table in the config.mdb and the autowhitelist.mdb.
  3. Do a search for your sample message ID
  4. The following log can be broken into two major parts, first the Whitelist then the Autowhitelist:
Whitelist:
 
  • Each message can have up to 4 SQL checks run on them such as the one below:
SQL: SELECT TOP 1 id FROM antispam2_whitelist WHERE (type=0 OR type=4) AND entry IN ('test@gfi.com')
  • Each check will be followed by the following:
...was not found in db ...
Executing Wildcard check [1]...
Wildcards did not whitelist any entries ...
  • This means the email address checked 'test@gfi.com' is not in the Whitelist
  • The Wildcard check checks for domains, such as '*@gfi.com' which also did not match
  • If any of the 4 SQL Checks match, the email was whitelisted
Note: More then one email address will be checked in the SQL queries, these match the SMTP Sender, MIME Sender, SMTP Recipient, and MIME Recipient.
  • If a match is found, instead of ...was not found in db ... you will see the following:
Found match in db ...
Message is Whitelisted...Skipping NDR / Out-Of-Office Check
  • This means you need to remove the address that was checked.  In this case, test@gfi.com
 
AutoWhiteList check:
 
  • If none of the SQL Queries match, an additional check will be performed on the AutoWhiteList
"Checking [test@gfi.com] against Autowhitelist ..."
"[test@gfi.com] is found in AWL"
"SETTING _bWhitelistMsg = true"
"MIME From (test@gfi.com) address is in AWL ..."
  • This means the address 'test@gfi.com' was found in the AutoWhiteList, it will need to be removed from there
  • If instead the address is not listed in the AutoWhiteList, you will see the following:
Checking [test@gfi.com] against Autowhitelist ..."
[test@gfi.com] is NOT found in AWL"
  • The last few lines of any email check that found a match should end with the following if the message was whitelisted:
"Setting block report to [Email address whitelisted]"
"GFI_ASEMSGPROPS_WHITELISTED = true"
"NDRSpamNewSenders = false"
'<< Message Processing Block"
">> Message Uninitialization"
  • If you instead do not get a match on the autowhitelist or the whitelist, you will see the following as the last few lines:
"GFI_ASEMSGPROPS_WHITELISTED = false"
"NDRSpamNewSenders = false"
"<< Message Processing Block"
">> Message Uninitialization"
"<< Message Uninitialization"