All email connections (spam and not spam) to a domain are logged to the logging server. To make sure a
connection can be logged, the “RCP TO” information needs to have been received. Connections are generally
only temporarily or permanently rejected after receiving this “RCPT TO” data, to ensure all connections being
available from the logging system. Connections may not be logged when ratelimiting is applied because of a
flood of connections from a certain IP, or when the sending server is violating certain requirements from the
RFC 5321.
Storage period
The connections logged are by default accessible for up to 28 days. Optionally it’s possible to store the
logging for a longer time, this can be configured in Spampanel.
Access
The logs can be easily downloaded or searched from the webinterface.
Delay
The logging data is processed every 10 minutes on all filtering nodes. The average delay for the connections
to be visible in the log search is therefore 5 minutes.
Information logged
• Date/time
• Server (email ID)
• Sender hostname/IP
• Sender address
• Recipient address
• Classification