Print Page | Close Window

quarantined email not delivered to all

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5113
Printed Date: 12 March 2025 at 7:56pm


Topic: quarantined email not delivered to all
Posted By: Terry
Subject: quarantined email not delivered to all
Date Posted: 29 March 2005 at 9:28am

It appears we may have a delivery problem here from quarantined email.  I am on version 2.1.2.406 and have gotten some complaints about quarantined email not being completely delivered.  An email destined for 3 internal recipients was quarantined.  One person delivered the message from quarantine but the other 2 did not get it?  Here are the relevent portions of the 2 logs:

Mail arrives and is quarantined for 3 people:

03/25/05 15:17:38:199 -- (1852) Connection from: 12.152.130.18  -  Originating country : United States
03/25/05 15:17:38:965 -- (1852) Resolving 12.152.130.18 - Error resolving IP address (DNS Server Reports Query Server Error)
03/25/05 15:17:39:011 -- (1852) - SPF analysis for bbl-inc.com done: - none
03/25/05 15:17:39:011 -- (1852) Mail from: mailto:SKIS-YOUNG@bbl-inc.com - SKIS-YOUNG@bbl-inc.com
03/25/05 15:17:39:277 -- (1852) - MAPS search done...
03/25/05 15:17:39:277 -- (1852) RCPT TO: mailto:davids@portptld.com - davids@portptld.com accepted
03/25/05 15:17:39:402 -- (1852) Mail from: mailto:SKIS-YOUNG@bbl-inc.com - SKIS-YOUNG@bbl-inc.com
03/25/05 15:17:39:402 -- (1852) RCPT TO: mailto:koehlk@portptld.com - koehlk@portptld.com accepted
03/25/05 15:17:39:511 -- (1852) Mail from: mailto:SKIS-YOUNG@bbl-inc.com - SKIS-YOUNG@bbl-inc.com
03/25/05 15:17:39:511 -- (1852) RCPT TO: mailto:summea@portptld.com - summea@portptld.com accepted
03/25/05 15:17:42:558 -- (1852) Found Keywords: [((?i)(font\-size\:[\x20]{0,1}(\d){1,}\.[1-9]{1,}[\d]{0,1}((\")|(\;)|(p(t|x)))))]
03/25/05 15:17:42:558 -- (1852) EMail from mailto:SKIS-YOUNG@bbl-inc.com - SKIS-YOUNG@bbl-inc.com to mailto:davids@portptld.com - davids@portptld.com , mailto:koehlk@portptld.com - koehlk@portptld.com , mailto:summea@portptld.com - summea@portptld.com matches content filter rules - rejected.
03/25/05 15:17:42:824 -- (1852) EMail from mailto:SKIS-YOUNG@bbl-inc.com - SKIS-YOUNG@bbl-inc.com to mailto:davids@portptld.com - davids@portptld.com , mailto:koehlk@portptld.com - koehlk@portptld.com , mailto:summea@portptld.com - summea@portptld.com was received and quarantined. Size: 300 KB, 307200 bytes
03/25/05 15:17:42:933 -- (1852) Disconnect

As you can see...3 recipients were on the email...here is the log for the release from quarantine:

03/28/05 07:25:01:280 -- (4092) Adding to d:\program files\spamfilter\AutoWhiteListForceDelivery.txt:SKIS-YOUNG@b bl-inc.com|summea@portptld.com
03/28/05 07:25:01:295 -- (4092) Delivering quarantined email from < mailto:SKIS-YOUNG@bbl-inc.com - SKIS-YOUNG@bbl-inc.com > to mailto:summea@portptld.com - summea@portptld.com
03/28/05 07:25:01:405 -- (3364) Sending email from mailto:SKIS-YOUNG@bbl-inc.com - SKIS-YOUNG@bbl-inc.com to mailto:summea@portptld.com - summea@portptld.com
03/28/05 07:25:01:420 -- (2884) Time to add Msg to Bayes corpus:0
03/28/05 07:25:02:030 -- (3364) EMail from mailto:SKIS-YOUNG@bbl-inc.com - SKIS-YOUNG@bbl-inc.com to mailto:summea@portptld.com - summea@portptld.com   was forwarded to 10.192.34.83:25

As you can see...only one recipient of the message recieved it and it was lost from quarantine....

Terry


Replies:
Posted By: mikek
Date Posted: 29 March 2005 at 9:41am

The message is quarantined for each recipient separately. When a user delivers the message to his inbox, only that users e-mail address gets added to the AutoWhiteList. So the other messages are not lost, they are still in quarantine.

 

Posted By: Terry
Date Posted: 29 March 2005 at 9:49am
That is not supposed to be accurate....the autowhitelist is indeed added for that one user but all recipients of that particular message will received the email that was released..Terry

Posted By: LogSat
Date Posted: 29 March 2005 at 6:31pm
Terry,

This is by design. As mikek statred, each time an email that has multiple recipients is received and quarantined, SpamFilter will store a separate record for each recipient in the database. This allows each user (each recipient) to force-deliver all their mail without affecting any possible other user. If one of your users may be interested in a Viagra advertisement, most likely the other recipients will not be and would not want to receive that email. Of course this example is an extreme, but illustates the idea behind this.


-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: Guests
Date Posted: 29 March 2005 at 7:31pm
The message was deleted for all the other recipients after the one user marked to receive their copy.  I don't think that is by design. 

Posted By: Terry
Date Posted: 29 March 2005 at 7:49pm

Okay...I am back on a different pc to answer this again...perhaps I didn't make the problem clear...

a) a message came into the system addressed to 3 people at our site

b) the message was quarantined

c) 3 days later the message was released from quarantine by one of the people and they received the message

d) the other 2 people did not receive the message and it was no longer in quarantine.....

This is not how it used to work nor how it should work.  I do not know if there was something different about this message but the log sure looks wrong to me.  Also I understand that only the one releasing the message from quarantine would add them to the autowhitelist...however you have told me in previous posts that all the recipients would get this specific email delivery. 

Terry

Posted By: LogSat
Date Posted: 30 March 2005 at 12:27am
Terry,

We double-checked the build 2.1.2.406 you are using, and we're not able to reproduce the problem. When an email arrives addressed to multiple recipients, one record is created in the database for each recipient. When one of the recipient force-delivers the email, his record is mailed to him, and the others are not removed from the database.

As you said this occurred 3 days after the email was sent, can you please check and let us know for how long you store quarantined emails? Is it possible that coincidentally the retension period expired, and those emails were deleted as part of the cleanup routines?


-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: Terry
Date Posted: 30 March 2005 at 9:23am

We store quarantine emails for 15 days.  The email in question was received on Friday and released on Monday.

What you are describing above is a complete change from what you have described in previous posts for the quarantine release process.  In prior discussions you very carefully explained that if 1 person released a message from quarantine all recipients of the specific email would get that specific message.  This was to preserve the email thread. 

Now you are telling me that this has changed.  I don't think this is right and I think it will cause lots of problems with people believing that everyone on the email recipients ("to") line got the message they received.

I know for a fact that this is not how prior releases worked with email delivery. 

ref...http://www.logsat.com/spamfilter/forums/forum_posts.as p?TID=5046&KW=quarantine

Posted By: LogSat
Date Posted: 30 March 2005 at 5:24pm
Terry,

The process has not changed. The posting you referred to deals with incoming emails where one or more of the recipients is whitelisted, and wether the email is delvered or not. SpamFilter will behave as described in that thread.

In the current thread instead we are talking about what happens to emails that are forced out of the quarantine database *after* they are blocked. This is a different situation/scenario, and SpamFilter will behave in the way I described above.

The two threads talk about two different cases. This is not to say that there may be another thread/email where I posted possibly incorrect information, that can definetly happen, and I apologize in advance if you find this was so.


-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: Terry
Date Posted: 30 March 2005 at 8:14pm

Okay...so I have this wrong...let me restate what I think you are saying so I can make sure I now understand it...

1) if an email comes into the system addressed to 1 or more recipients and that sender is in the autowhitelist for any 1 of the recipients...then that email is delivered to all recipients

2) if an email comes into the system addressed to 1 or more recipients and that email is quarantined then if 1 person does a send function then an autowhitelist entry is made and only that 1 person gets the message ... not the others on the "to" line unless they also release it from quarantine....

Is that how it works?  Please let me know if this is correct........

Still don't know why the message disappeared as stated in the start of the post... 

Posted By: LogSat
Date Posted: 30 March 2005 at 8:35pm
Number 2 is correct. For number 1 I'll refer you back to the posting you mentioned in this thread, as the answer to that is "it depends", and the other posting has more details on what can happen under some circumstances.

As far as the emails disappearing form the quarantine for the other users, yes, that is odd if the retension is 15 days. Other than simple explanations like "could it be that the other users emptied their quarantine?" I honestly do not have an answer to that right now.


-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP


Print Page | Close Window