Blocking outgoing empty subject mails

[mlynch_ironport]

Hi,
I can drop empty subject mails easily on the incoming side, but how do I drop or redirect outgoing empty subject mails?

[Andrew Wurster]

depending on how you are doing it currently - it should not be too difficult to translate your existing incoming content or message filter to be used in the outgoing direction. what is your exact filter syntax?

andrew

[mlynch_ironport]

Edit Content Filter
—


Content Filter Settings
Name:
Currently Used by Policies: Default Policy
Description: Incoming Mail with no subject tags
Order: 1 2 3 4 5 (of 5)

Conditions
Apply rule: If one or more conditions match Only if all conditions match
Order Condition Rule Delete
1 Subject Header subject == "^$"
2 Subject Header subject == "FW:^$"

Actions

Order Action Rule Delete
1 Change Recipient to alt-rcpt-to ("administratorUS@uhlmann-usa.com")

These syntax do not seem to work for an outgoing filter

[Andrew Wurster]

A few things:

1 - I think you just copied and pasted the HTML content, including buttons and pull down menus - some of that output makes it difficult to understand the actual filter settings. i usually ask people to send either a screen shot, or send the output from the "outgoing / incoming content filters screen" with the "rules" view selected. mine looks like:

2 - I don't know if your second condition will ever be met:
'^FW:$'.
Instead, I would use something like '^(i?)FW:$' (and I would even add '^(i?)RE:$' too). Here's what mine looks like:

empty_subject: if (subject == "^(?i)FW:$") OR (subject == "^(?i)RE:$") OR subject == ("^$")) { alt-rcpt-to ("awurster@ironport.lab"); }


the only reason I can think of this not working are: A) the sender / recipient is placed in the wrong outgoing mail policy or B) there is a content filter matched before hand that is bypassing this one. perhaps you could send in your mail_logs from a test message for debugging?

thanks!

andrew


Here's a snippet from my own test using that filter:
Thu Jul 23 16:56:30 2009 Info: MID 72 Subject 'fw:'
Thu Jul 23 16:56:30 2009 Info: MID 72 ready 485 bytes from
Thu Jul 23 16:56:30 2009 Info: MID 72 matched all recipients for per-recipient policy DEFAULT in the outbound table
Thu Jul 23 16:56:30 2009 Info: ICID 40 close
Thu Jul 23 16:56:30 2009 Info: MID 72 interim verdict using engine: CASE spam negative
Thu Jul 23 16:56:30 2009 Info: MID 72 using engine: CASE spam negative
Thu Jul 23 16:56:30 2009 Info: MID 72 interim AV verdict using McAfee CLEAN
Thu Jul 23 16:56:30 2009 Info: MID 72 interim AV verdict using Sophos CLEAN
Thu Jul 23 16:56:30 2009 Info: MID 72 antivirus negative
Thu Jul 23 16:56:30 2009 Info: MID 72 rewritten to MID 73 by alt-rcpt-to-filter filter 'empty_subject'