KB Article #102171

Automating submittal of uncaught spam messages to the Message Protection Lab

Automating submittal of uncaught spam messages to the Message Protection Lab

Summary:

You may want to set up an email address in your domain where users can submit spam messages. You may also want to set up this address to forward a copy of the mail it receives to spamlab.miss@tumbleweed.com. If you do this, Tumbleweed requests that you also take the following steps to ensure that spam is forwarded in the preferred format.

Resolution:

  • Create an attachment list that contains a single entry with Specification Style Standard MIME Type and Attachment Type message/rfc822. In this example, the attachment list is named “Message Attachments”.
  • Create a notification and select the option for the notification to be sent to the Original Message Sender. (This notification will be sent to the person who is submitting the spam message, not to the originator of the spam message.) The text of this notification should explain that spam messages must be forwarded as an attachment. In this example, the notification is named “Please Forward As An Attachment”.
  • Define a policy to drop any message that does not contain a message attachment. The summary of the policy should look like this, when viewed in EMF Web Admin:

    Policy Type: Basic Mail Filtering
    Applies To: Recipient
    Summary of Policy, ready to save:
    But exclude messages where…
    contains attachments in the attachment list “Message Attachments”
    Take the following actions…
    Drop the message
    and send the notification “Please Forward As An Attachment”

  • Create a user record in the External folder of your EMF directory for the address spamlab.miss@tumbleweed.com.
  • The policy defined above should be applied directly to this user record.
NOTE: Some email clients (e.g. Microsoft Outlook Web Access version 5.5) do not allow recipients to forward messages as attachments. If you have a significant number of users that normally use clients with this restriction, the policy described here should not be deployed.