Multiple Disclaimer text on Ironport X series

[noraarellano]

Hi everyone!

I'm having a strange behavior with the disclaimers in my appliances.

All the email sent to Internet has to have a disclaimer text, I add this disclaimer through a outgoing content filter and noticed that sometimes the email adds it correctly and sometimes adds double or even triple disclaimer.

I checked under text resources all my disclaimers and is correctly written (just one time). The only thing that concerns me is that I have my disclaimer text under "HTML" version and the same disclaimer under "Plain Text Alternative". 

I understand that if it is not possible to display the HTML version it will display the Plain Text Version... and I'm thinking if, due to a bug in the AsyncOS or something, is sending me both versions (html and plain text) instead of choose just one. (this because, in my case, both versions are the same, dont have any difference).

Do you know something about it? Is anyone having this problem?

Regards

[Paul Cardelli]

I personally do this in our exchange server currently, but I'll take a shot at this.

Is it possible that you have more then one outbound filter configured with the the Disclaimer Text? 

If so then you will want to make sure that the filters you configure the disclaimer text are final, otherwise your outbound message may complete the one filter, then move to the second filter with the same action, and it will add the disclaimer text again. Better yet, make sure your disclaimer text is only in one out going filter.

[noraarellano]

Hi!, Thanks for your response.

I have 5 outgoing content filter, every filter have to "catch" the outbound email depending on the domain they belong, so I have  1 content filter for @domainA.com one another for @domainB.com and so on.

For each outgoing filters i have 1 disclaimer text, so every disclaimer is different. Maybe is happening like you said, that some emails are going out passing by 2 or 3 outgoing filters and adding the correspondent disclaimer... I will make some testing and let you know

Regards!!!

[Paul Cardelli]

Yeah no problem, I noticed this behavior with a couple of my URL filters the other day where the one message would end up in two or more quarantines. I figured this would be one place to start looking as it is easy to overlook.

If you find one of the messages that received two disclaimer texts, try using the Message Tracking, it should tell you which filters where hit. (I have a habit of adding a log action for each of my filters to make them standout more in the message tracker such as <----FilterName---->)

It is likely you have conditions on your filters based on the domain. I would double check these filter conditions to make sure one is not a subset of the other. It is possible you may have missed a condition on one of the offending filters.