Messaging Gateway

what exactly this undisclosed recipients mean?


And is there any way to block them or avoid them from entering into our environment under BRIGHTMAIL GATEWAY?

The undisclosed recipient might not even be in your domain.   You should have an envelope recipient(s) that are receiving the e-mail.  Is there a reason the valid recipients are concerned?

An undisclosed recipient is someone that was put into the BCC field on the email client. Mail Tranfer Agents are required to mask that information per RFC compliance.

There is no built-in mechanism in the Brightmail Gateway to block messages to addresses in the BCC field. You could theoretically try to block a message if anything is in the BCC field but that would most likely bring some undesirable effects.

Thanks for ur Quick responsses....

How can we block the Undisclosed recipients theritically?

Yes there is a reason of concern for the valid recipients.  Users unkowingly recieving these messages.We blocked that doamin at brightmail.

But the user is also insisting is there any way to stop these mails under undisclosed recipients.Can we do this at mail server if not possible at brigthmail?


Also one more thing, when one user is trying to send a mail a unkown signature which is not set by him is attached to his mail.Why does this happen?

When one user is trying to send a mail a unkown signature which is not set by him is attached to his mail.
-  Does your outbound mail flow add a "legal disclaimer" anywhere?  SBG has one, do you have it enabled?

Undisclosed recipients:

Undisclosed recipient are what happens when the sender of the e-mail uses the BCC: field to send an e-mail.  Brightmail can't control what the sender does.  So if I send a message:
   from: phhowe17
   to: prasad.ganta
   bcc: my.lawyer

You will see the from, and only you as the to. If the sender ONLY uses the BCC: field, then Exchange shows no receipients.  The message headers do show "To: undisclosed recipients: ;"

I suspect you are discussing spam, and not business e-mails.  Other than blocking the sending IP address, or sending domain, there is not much you can do.

I tried this - create a content policy that has this:

Conditions:
  (If text in To/Cc/Bcc Address part of the message contains 1 or more occurrences of "undisclosed" )

I've found that the To: header may have a variant of undisclosed receipient, undisclosed-recipient, etc.  It may even be in the langage of the sender.   Careful, as this may have unexpected side effects (e.g. sent to a distribution list that has the word in it) and this checks the To and Cc fields as well..