Recipient logic when attachments are stripped

[Peter Peters]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

James Gray wrote on 25-2-2005 23:50:
> On Sat, 26 Feb 2005 09:34 am, Julian Field wrote:
>
>>James Gray wrote:
>>
>>>Got a interesting one, that is probably a quick answer.  Yesterday we had
>>>a message come in addressed "To:  <distribution-list>", "Cc:
>>><another-list>". Both lists are on the Exchange server which is protected
>>>by the MS server in front of it.  Now the message had an attachment with
>>>a double extension which was caught and quarantined (good).  However, the
>>>list in the "Cc" didn't get the message (so I'm told).  Now this could be
>>>people attempting to cover their a$$ but the fact they raised a trouble
>>>ticket (which means they will be found out if they're telling porkies)
>>>casts some doubt on that theory.
>>>
>>>So my question is; does MailScanner drop the Cc/Bcc list when a problem
>>>with a message is detected, or does it honour the recipient list?
>>
>>MailScanner doesn't even look at the To: CC: and Bcc: headers, it uses
>>the recipients in the envelope which will include all three.
>
> Awesome.  This is what I always assumed, but when you have "C-level"
> management swearing they didn't receive a message all because of my mail
> filter, you tend to doubt yourself :P  I saw the mail log with MS just
> forwarding it on sans offending attachment to sendmail which then delivered
> it to the Exchange box, but manglement were still swearing.... you get the
> picture?

 From the message that came through you should be able to get the
queueID on your MS box. With that ID in hand you can get the complete
logging including the delivery (attempts) on the exchange box. I have
had this a couple of times and with the log line telling me exchange has
accepted the message I could always point the complainant in the right
direction (Mostly overactive filtering in their outlook client).

--
Peter Peters, senior beheerder (Security)
Dienst Informatietechnologie, Bibliotheek en Educatie (ITBE)
Universiteit Twente,  Postbus 217,  7500 AE  Enschede
telefoon: 053 - 489 2301, fax: 053 - 489 2383, http://www.utwente.nl/itbe

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!