MMS sends the wrong notification or too many notifications
This article was previously published as ID#29404

Summary:
This technote attempts to address several similar/related questions:

Why is MMS sending the wrong notification?
Why is MMS sending 2 notifications when only one policy took effect?
Why is MMS sending a quarantine notification when the message was dropped?

Detailed Information:
Whenever multiple policies apply to the same message, if they have different dispositions (i.e. process normally/quarantine/drop) only the most severe one (in this example: Drop) will take effect.

However, notifications are not tied to the disposition in any way. If the policy is triggered, and it says to send a notification, the notification is sent, even if a different policy's disposition takes precedence.

Say 3 policies are in place and are all triggered for a particular message:
1. catch mail sent from user@example.com / process normally and send notification to Administrator
2. catch mail with attachment example.doc / quarantine and send notification to Administrator
3. catch mail with viruses / drop

Because Drop is the most severe, that is the action that will be taken on the original message. The other 2 notifications will still be sent.

Resolution:
Note: please also see this newer article on unwanted notifications which has an alternate workaround.

This behavior cannot be disabled. When writing notifications, you should bear in mind that the notification may still be sent even if the message is dropped by a different policy.

Possible configuration changes in light of this include:

1. You may make an exception to the policy so that notifications are only sent under certain circumstances.
example:
catch messages with attachment example.doc / EXCEPT when sender is user@example.com / quarantine and send notification

2. You might word the notification in such a way that the user who gets it understands it might be overriden by a more sever policy.
example:
You are receiving this notice because the banned attachment xyz.exe was sent to you and has been quarantined. If you need this attachment for business purposes, you can request it from the administrator. Note: If the message was infected with a virus, it will not be available.

Status:
verified

Original Author: ACUNY
Original Submitter: ACUNY
Keywords: policy trigger except exception unwanted notifications MMS ID#29404