Getting spam marked "Domain Allowed"?

[--VQ--]

Have you recently been getting spam with the control stripe "Domain Allowed"? If you don't recall adding the domain to your Domain-Allow list, then it was probably added by SurfMatch. That feature is designed to admit mail from sites at which you make a purchase or at which you entered personal data into an online form.

But don't worry. It's easy to train Domain Match to exclude popular domains from automatic entry onto the Domain-Allow list. Let's first explore how SurfMatch works...

Surfmatch temporarily admits mail from domains at which you recently made a purchase, submitted a form, or logged in. This includes secure sites that remember you, even if you no longer are required to log in.

But this can create a nuisance. If you log into the control panel of your internet provider (say, Comcast.net), then anyone showing a Comcast address is suddenly admitted into your mailbox.

To avoid this problem, SurfMatch does not automatically add the big ISPs to the Domain Allow list - including popular web sites those that also operate mail services, such as AOL, Yahoo, Google, and Netscape.

Is it unfair to users of these services? Good question! Actually, their exclusion from SurfMatch is unlikely to be noticed, because SurfMatch is intended to admit commercial mail from sites at which you initiate a relationship. These sites use their own domain name (for example, www.DiscountDVD.com ), even if they are actually hosted by a popular service such as Yahoo Stores or if the business owner uses Google for his personal email.

But if we excluded every popular web service, SurfMatch would be less effective. Now, let's suppose that you log into the control panel of your own ISP. Soon, you begin to notice spam slipping through because the spammer is showing an address at the same ISP.

Fortunately, there is an easy way for you to prevent spam "leak-through". Whenever you see spam with "Domain Allowed" control stripe, simply click Exclude. This will not block the domain. It only means that you do not wish for that domain to be automatically added to your Domain-Allow list simply because you logged into a matching web page. In no time at all, the secure web sites that you visit will be admitted by one of a dozen alternate rules, but not by SurfMatch.

Vanquish pre-populates the Domain Exclude list with the most popular email address services such as AOL, Yahoo, Hotmail, Google, Netscape, Cox, Verizon, and Comcast. We also include companies that the targets of phishing attacks such as PayPal, eBay and CitiBank. If you remove these sites from your Domain Exlude list, you will be more likely to receive spam and phishing attacks. [Complete List]

[tortoise62]

There is no "Exclude" link that this topic indicates. Valid options are Remove, Block, and Details.

Remove would certainly remove the domain from the allow list (which was auto-added) - however, wouldn't SurfMatch simply re add the domain the next time the domain was visited?

I administer vqSA, and the domain(s) in question were craigslist.org and yahoo.net - auto added - presumably by SurfMatch.

I removed the domain and instructed the user to do the same in the future, but why isn't the Exclude link available?

[--VQ--]

You are correct. I have just confirmed that in a recent server update, the Exclude link was dropped from the "Domain Match" Control Stipe.

This was probably an oversight - and was not picked up in the regression test. We will try to get this slipped back in. But the test rules may delay this process until we revisit that section of the user interface.

Either way, the situation is rare. If you want to add it to your exclude list you can do so with a few clicks... Click 'V' and choose View | Domain Lists. Drop it right into the entry box and click Exclide Domain.

[mbterry9@vqme.com]

When I got my 2nd spam in 2 days, as of 12/26/08 my strip says only: "DOMAIN Match, Remove, Block." Which I believe offers me only 2 choices of action. In 20 mins of studying online, I cannot find out what "Remove" means or does. The Domain is gmail, and I don't want to block all emails from that. The online manual has stripes that I think were superceded months ago. Once upon a time, I could block individual addresses, but that does not seem available now.

[--VQ--]

Hi MBTerry9,

You can indeed block and admit individual addresses. But not from the Domain Allow stripe...

In this case, you enabled gmail to jump to the Domain Allow list, because at some time in the past you accidentally removed it from your Domain Exclude List. The Exlude List is not a block list. It is very different.

The Domain Exclude list (which includes gmail.com by default) suppresses the SurfMatch feature for popular domains such as free email services and commonly fished sites. Normally, SurfMatch silently whitelists small businesses from whom you purchase or when you log into an online account. The Domain Exlude list prevents Domain Match delivery from spammers who show an address from a major email service or commonly phished domain - even though you may ocasionally log into their servers. That is, these larger domains are "excluded" from the SurfMatch feature.

It's easy to restore gmail and another 40 or so default domains to the Exclude list. Check out the link at the bottom of this page and then paste the list directly into your Domain Exclude list.

[mbterry9@vqme.com]

I understood only a little of what you wrote.

This whole SURFMATCH subject is confusing to me - is this something Vanquish came up with, or someone else? I can't see that it does anything good; I gather that we should get around it by using the Domain Exclude list.

But the most frustrating thing was trying to do as you instructed: "Check out the link at the bottom of this page and then paste the list directly into your Domain Exclude list."

I hit every link I could find at the bottom of the page, and then followed each trail, but did not come up with a list to paste directly into my Domain Exclude list. (Of course I have no idea what this "list" looks like.) I spent about 10 mins doing this. I don't know why you did not just give me the link rather than sending me on this blind alley hunt.

Mike

[--VQ--]

Regarding your first statement, the SurfMatch feature is a quite popular. It adds a clever capability to the overall security service. You asked if Vanquish came up with this feature: Yes! It is completely designed in house and we are the only company that has anything like it. It is the only part of our service that is installed on your own PC (instead of our servers). It is described here.

The Exclude List is of no value if you are not using SurfMatch. It simply means that the domain is "excluded" from the SurfMatch feature. For more details about this aspect of SurfMatch, click here.

Finally, regarding your trouble with adding back the missing entries to your Exclude list, this is more appropriately discussed on a support ticket. I will be glad to assist you on the phone or with a screen-sharing session. Please submit a support ticket.