Was thinking about this and I have a question

if I had the keyword hello:null which is common to the mydoom virus, once this is implemented instead of being sent to the quaruntine it is sent to null. Is it possible to have the message dropped before the attachment is accepted? This would save alot of bandwidth for the bigger isp's if this was possible.

Kevin

Even thought very desirable, that is unfortunately not feasible. The msg must be received in full before checking it for keywords. One of the reasons is that there's a keyword whitelist. If a keyword is specified that would cause the msg to pass no matter what, then even though a blacklist keyword is found, the message has to be received in whole to ensure the last work in it is not in the whitelist.

Roberto F.
LogSat Software