Messaging Gateway

 View Only
Expand all | Collapse all

Content Compliance --Did i find a bug in SMS for SMTP 501?

  • 1.  Content Compliance --Did i find a bug in SMS for SMTP 501?

    Posted Nov 11, 2008 10:56 AM

    Hi, we are using SMS for SMTP 501 on a windows server.

     

    Problem is this: I created the following inbound content compliance policy to add a BCC field for emails coming to a general company account.

     

    Policy -->

     

      Conditions:  If the From/To/Cc/BCC: address contains 1 or more occurrences of "abc@abc.com"

      Actions : Add BCC recipients to "def@abc.com"

     

    Problem: Emails are indeed BCC`ed to the def@abc.com account, however it seems that these emails are not checked for virus/spams. When a spam/virus message sents to abc@abc.com, both abc and def users get these emails without any check!

     

    Additiona Information:

     

    1- I added this content policy as the LAST policy, thinking it will be executed AFTER all other tests/checks,

     

    2- An example spam message log in Message Tracking is as follows:

     

    -------------------------------------------------------------------LOG STARTS--------------------------- 

    Message Data  
     ID: ac100107-000012380000052c-ed-4919a7ac1c4a
     Message-ID:  
     Accepted From: 78.93.79.123
     Scanners: Local Host   
     Time accepted: Tuesday, Nov 11, 2008 05:41:32 PM EET
     Direction: Inbound
     Sender: info@hsi.cz
     Original recipients: abc@abc.com
     Original Subject: [8]: участки под усад
    Recipient Data  
     Intended recipient: abc@abc.com
     
     Verdict: Disposition                            Filter Policy    Group Policy
                 Content compliance violation  abc-ınbound    default  
     
     
     Actions taken: Add BCC recipients   
     
     Delivery: Delivered To Delivery Time
    10.0.1.4:25  Tuesday, Nov 11, 2008 05:41:32 PM EET  
     
     
     Viruses: None  
     Attachments: None  
     Other recipients: def@abc.com
      
    -------------------------------------------------------------------LOG ENDS---------------------------

     

    What we expect normally:  SMS for SMTP first check whether an email is spam/virus or not, and then after verifying its a normal email then should run content compliance rules (such as add Bcc and etc.)

     

    Question: Are we performing something wrongly or is this a product bug?

     

    Thank you for your responses/time in advance and look forward to hear from you soon,

     

    Emre CELEBI

    Information Security Eng. 

     

     

     



  • 2.  RE: Content Compliance --Did i find a bug in SMS for SMTP 501?

    Posted Nov 12, 2008 07:11 PM

    Something doesnt seem to be adding up...this is straight from the KB

     

    Order of precedence:

    •  
      • Virus attack
      • Worm
      • Virus
      • Spyware or adware
      • Suspicious attachment (suspected virus)
      • Unscannable
      • Encrypted attachment
      • End user-defined Allowed Senders List
      • End user-defined Blocked Senders List
      • Administrator-defined, IP-based Allowed Senders List
      • Administrator-defined, IP-based Blocked Senders List
      • Administrator-defined, domain-based Allowed Senders List
      • Administrator-defined, domain-based Blocked Senders List
      • Spam attack
      • Directory harvest attack
      • Safe Senders List (part of the Sender Reputation Service)
      • Open Proxy Senders (part of the Sender Reputation Service)
      • Third Party Services Allowed Senders List
      • Third Party Services Blocked Senders List
      • Content Compliance policies
      • Dropped invalid recipient
      • Spam
      • Blocked language
      • Suspected spam
      • Suspected Spammers (part of the Sender Reputation Service)
      • Sender authentication failure

    Note: End user-defined allow/blocked lists have precedence over all other lists. This may affect your decision regarding whether to enable end user preferences.
    Also, lists that you create have precedence over lists created by Symantec. However, third party DNS blacklists do not have priority over all Symantec lists.
    In the event of a conflict between Open Proxy Senders and an entry from a DNS blacklist, Open Proxy Senders will “win.”