Outlook oddities #2

[Steve Campbell]

Thanks Glenn,

Glenn Steen wrote:
> On 17 March 2010 20:45, Kevin Miller <Kevin_Miller at ci.juneau.ak.us> wrote:
>   
>> Steve Campbell wrote:
>>     
>>> The warning in MW indicates "no watermark or sender address" so I
>>> think I can do a hex dump on the quarantined file and see what's
>>> causing the corruption.
>>>
>>> I'm still a little confused about having the address whitelisted from
>>> which these users are sending, and why SA complains since it isn't
>>> supposed to be checking these because of that.
>>>       
>> I never noticed it before, but all the whitelisted entries have SA scores associated with them.  Apparently SA runs regardless, but just passes them if whitelisted...
>>     
Kevin,

I'm not sure this is true in this case. The IP is whitelisted, but the 
SA stuff is short-circuited by the From: and watermark problems. No SA 
score is shown on these RR thingys.

Thanks.
>> ...Kevin
>>     
>
> If you have the "Always include SA score" setting (probably named
> slightly different... Bad memory day:-), MS will have to run SA for
> everything, whether it is used as a "sorting criterion" or not.
>
>   
I do have that set, but apparantly, the watermark section takes 
precedence over the SA section.
> That Steve has problems with the watermark feature (which is an MS
> feature) marking some return receipts as spam ... kind of suggest the
> sollution itself, doesn't it? Juts put a similar ruleset on that as
> you have for the spam whitelist ... and presto, problem solved;-).
>
>   
I had already considered this as a "workaround" but was hoping to find a 
solution to the real problem (Outlook). Of course I'm still wondering 
what is going on that makes a RR differ from normal mail sent and why 
something is missing or corrupt to make MS/SA think there is a problem 
in the first place.

Based on what I see, the From is corrupt or something and the watermark 
isn't there. I might be looking at the files at the wrong time (in the 
timeline of the email). But shouldn't these RRs go through the same 
process as a normally sent email?
> The settings to look at/put a ruleset on are (one of, depending on the
> effect you want):
> Check Watermarks With No Sender (to simply check/not check watermarks
> for the whitelisted IP addresses)
> Treat Invalid Watermarks With No Sender as Spam (to choose a different
> action... "nothing" seems appropriate for the whitelisted ones:-)
> But don't use "Use Watermarking" for the whitelist, since that would
> effectively turn the feature off for relayed mail;-).
>
> Cheers
>   

I'm going to try and see what the above will accomplish. Again, thanks 
for the help.

steve