FAQ

Can I rollover all of the email stat dates

Thu, 06 Aug 2009 12:12:43 GMT

Yes.

Run MEConsole with the command line switch "/Rollover"

This will move all of the statistics to the correct count area, day, month and year.

What is "The Message Command File Is Missing" ?

Thu, 06 Aug 2009 12:12:11 GMT

This normally means that the MEFilter.Cfg file is not setup correctly.

Make sure the directory specified in the MEDataPath setting is correct and points to the "Mail Enable" directory.

Can I automatically export all email stats ?

Thu, 06 Aug 2009 12:11:35 GMT

Yes.

Run MEConsole with the command line switch "/Export"

You can change the output path by setting the "EMailStatsUserPath" entry in your MEFilter.Cfg file.

The default path is "C:\Program Files\Mail Enable\MEFilter\EmailStats\"

What are "Macro Keywords" or "Translation Codes" ?

Thu, 06 Aug 2009 12:10:48 GMT

These are special words that can be placed into certain files and settings and will be replaced with other values during processing. The following are available:

%SUBJECT% - The subject from the original message.
%MAILFROM% - The names in the 'To' from the original message.
%MAILTO% - The names in the 'From' from the original message.
%SMTPFROM% - The names in the 'To' given to the SMTP server.
%SMTPTO% - The names in the 'From' given to the SMTP server.
%DATE% - The current date.
%TIME% - The current time.
%NOW% - The current date and time.
%FILENAME% - The actual MailEnable message filename.
%TEXTBODY% - The actual text body of the email message.
%HTMLBODY% - The actual HTML body of the email message.
%MESSAGEID% - The MailEnable unique Message ID.
%SPAMMATCHES% - The phrases that were matched with the defined spam phrases.
%PRAADDRESS% - Primary Responsible Address.
%SPFRESULT% - ME SPF Return Code.
%SPFHEADER% - ME SPF email header text.
%SENDERDOMAIN% - The domain of the sender.
%RECIPDOMAIN% - The domain of the recipient.
%DIRECTION% - The direction of the email - 'Incoming' or 'Outgoing'

What is UserMove ?

Thu, 06 Aug 2009 12:10:21 GMT

UserMove is a new email action that can be used for some filters.

If this option is set and an email meets the filter criteria, the email will be moved directly into the users mailbox in to the folder defined in the MailMove folder setting.

NOTE: Doing this will bypass any futher options that may be run by the MailEnable MTA process.

Full registration is required to use this option.

What is PRA ?

Thu, 06 Aug 2009 12:09:51 GMT

What Is It.
The "Purported Responsible Address" (PRA) is used in an attempt to find who is the actual email sender using a set method of deriving the PRA from the actual message headers. The method I have used is defined in the draft "Internet Engineering Task Force" (IETF) document "MTA Authentication Records in DNS June 2004"

Where Can I Read More.
The latest copy of the document should be available Here.

You can also find a lot more about this sort of thing Here.

The Specification I Used.
The purported responsible address (PRA) of a message is determined by the following algorithm:

1. Locate the first non-empty Resent-Sender header in the message. If no such header is found, proceed to step 2. If it is preceded by a non-empty Resent-From header and one or more Received or Return-Path headers occur after said Resent-From header and before the Resent-Sender header, proceed to step 2. If the Resent-Sender header is hopelessly malformed (e.g. it appears to contain multiple mailboxes, or if the single mailbox is hopelessly malformed) then exit, without returning a PRA. Otherwise exit, returning the mailbox from the Resent-Sender header as the PRA.

2. Locate the first non-empty Resent-From header in the message. If no such header is found, proceed to step 3. If it is hopelessly malformed (e.g. one or more mailboxes in the header are hopelessly malformed) then exit without returning a PRA. If it contains multiple mailboxes, then exit without returning a PRA. Otherwise exit, returning the single mailbox from the Resent-From header as the PRA.

3. Locate the first non-empty Delivered-To, X-Envelope-To or Envelope-To header in the message. If no such header is present, proceed to step 4. If it appears to contain multiple mailboxes, then exit without returning a PRA. Otherwise, treat the contents of the header as a mailbox, and exit returning this mailbox as the PRA (unless the mailbox is hopelessly malformed, in which case exit without returning a PRA).

[Note. This means that a non-standard header that does *not* contain a single valid mailbox will cause the PRA algorithm to fail and may cause the message to be rejected. But anything else means that the process doing the MARID checks might make a different decision as to the validity of the mailbox from a subsequent MUA which attempts to display the purported responsible address by parsing the headers. Maybe it would be better to drop this step, and go back to only considering RFC(2)822 headers?] Lyon, Wong Expires - December 2004 [Page 6] MTA Authentication Records in DNS June 2004

4. Locate all the non-empty Sender headers in the message. If there are no such headers, continue to step 5. If there are multiple such headers, exit without returning a PRA. If the single non-empty Sender header is hopelessly malformed (e.g. if it appears to contain multiple mailboxes, or if the single mailbox is hopelessly malformed), exit without returning a PRA. Otherwise, exit returning the mailbox from the Sender header as the PRA.

5. Locate all the non-empty From headers in the message. If there are no such headers, or multiple such headers, exit without returning a PRA. If the single non-empty From header is hopelessly malformed (e.g. it contains one or more mailboxes that are hopelessly malformed) then exit without returning a PRA. If it contains multiple mailboxes, exit without returning a PRA. Otherwise, return the single mailbox from the From header as the PRA.

What is the GAP Filter ?

Thu, 06 Aug 2009 12:09:03 GMT

The Gap filter tries to catch emails that don't get caught by normal filtering methods.

A lot of emails now are sent with a large number of large unassociated words which are normally used to get past Bayesian filters. They generally have an HTML link or a image attachment embeded in the email.

This routine counts words in emails based on size and the actual number of words. If the percentage of large words is greater than the specified limit a match is made.

It is then possible to specify if a HTML link or an Image also has to be in the email before a full match is made.

What is Challange/Response Filtering ?

Thu, 06 Aug 2009 12:07:34 GMT

Challenge / Response filtering (C/R) is a very simple way of making sure senders of emails do actually exists. The basic flow is:

1. A local recipient signs up to the service.
2. When someone sends an email to the recipient, if they have not already authenticated their email is placed into a holding area.
3. A authentication email is sent to the sender which includes an authentication key, to which they have to reply.
4. When the sender replies sending the authentication key, their email address is mapped to the original recipients email address and no further authentication is required.
5. The original email is also released from the holding area when the sender has authenticated.
6. Authenticated users still have to pass all other filtering configurations once they have authenticated.

That's it in a nutshell.

How do I use SPF Filtering ?

Thu, 06 Aug 2009 12:07:06 GMT

Firstly you need to be running a version of MailEnable that supports SPF. Currently that is from Pro version 1.5 (which is currently in beta as 19th Sept). Then follow the steps below.

1. Enable ME SPF functionality. This is done by enabling the SMTP settings in ME.
2. Set the MEConsole settings as required using the Configuration Editor.

If you want to know more information please visit http://spf.pobox.com

How do I user EMail disclaimers ?

Thu, 06 Aug 2009 12:06:36 GMT

The Message Splitting option MUST be enabled.
For each domain you want to have a disclaimer, create a directory in the "MessageDisclaimerPath" for the name of the domain eg "MyDomain.Com"
If you want a text disclaimer create a template file called "Disclaimer.Txt" in the directory with your disclaimer text.
If you want a HTML disclaimer create a template file called "Disclaimer.Html" in the directory with your disclaimer HTML.
If both files exists, only the HTML disclaimer will be added to the message.

How do I use "MEMailMove.Exe" ?

Thu, 06 Aug 2009 12:06:12 GMT

The following needs to be configured:

Add the new "SpamFilterFolder" to the MEFilter.Cfg entries (see the config page).
Add the new "BlackListFolder" to the MEFilter.Cfg entries (see the config page).
Add the new "MailMoveHeaderKey" to the MEFilter.Cfg entries (see the config page).
Place the program "MEMailMove.Exe" into the MEFilter directory.
Change the Mailbox Delivery Event to run the program "MEMailMove.Exe".
NOTE: If you use the "MoveMail" functionality, messages will be headers will be added to detected emails even if you have not setup the delivery event. This will also mean that detected email will NOT go into any central holding area. You can override this functionality on a domain basis.

How do I use the database options ?

Thu, 06 Aug 2009 12:05:45 GMT

To use the database options you need to do the following:

1. Copy the MEFilterDB.mdb file to your system
2. Create a "System DSN" in the ODBC settings to point to the file and name it "MEFilterDB"
3. In MEConsole enable the database option.
4. Restart MEConsole and make sure there are no errors in the log file.
5. Enable the database options you require. DO THIS ONE AT A TIME
6. Using the ""Database Maintenance" menu option import the required config files.
7. Test and Test again.
8. If you have problems, Disable the Database options and report the problem.

Message Splitting - What is it ?

Thu, 06 Aug 2009 12:04:51 GMT

Many times I have been asked what message splitting is and why it is needed, so here I will try and expalin.

At the point of processing an email MEFilter only has one copy of an email which could be addressed to multiple recipients of multiple domains and mailboxes. So when MEFilter first gets an email, it splits the email into multiple copies, one for each recipient.

This then allows MEFilter to apply seperate filtering rules for each domain when it processes this split emails.

It also means that when an email is placed into a holding area, only the single recipients copy of the email is held. If the original (non split) email was placed into a holding and one of the recipients released the email, all recipients would get a copy delivered to their mailbox.

Is it needed ?

Yes is the basic answer, if you want to use the majority of the functionality within MEFilter then messae splitting does need to be enabled. If not the extened functionality just will not work correctly.

Does it place a bigger load on the server ?

Yes, I am affraid it does, it means if you have an email going to 10 people, that email will be processed 10 times.

What outgoing message API should I user ?

Thu, 06 Aug 2009 12:04:18 GMT

This depends on a number of things.

You can only use the ME API if you have MailEnable Pro installed.
If you need addition server authentication when send email use the MS API.
If you want to send both text and HTML notification emails use the MS API

Setting Up Daily Holding

Thu, 06 Aug 2009 12:03:38 GMT

1. enable dailyholding and requestholding in the mefilter console [Additional Settings 2]

2. create a dailyholding@yourdomain and requestholding@yourdomain email address in MailEnable

3. Send an email from user@yourdomain to dailyholding@yourdomain
(you will get a reply soon after that you are added to the holding report)

4. To test, send an email from user@yourdomain to requestholding@yourdomain
(and you should get a reply)

5. Start the console with "c:\Program Files\Mail Enable\MEFilter /dailyholding"
(and as suggested, you could do this as a scheduled daily task)

What is the filtering order in MEFilter

Thu, 06 Aug 2009 12:03:04 GMT

OOO
AutoRelease processing
Filter Exclusion
Message Holding
SPF
Whitelist
Blacklist
IPBlacklist
C/R Response
SpamDelete
Headers
Blank
Gap
Encryped File Filter
Attachment Filter
SURBL
Spam

Later version of MEFilter allow for user defined filter ordering.

MEFilter API

Thu, 06 Aug 2009 11:59:41 GMT

The MEFilter API allows you to access the registry settings used by MEFilter at both a global and domain level. This API can only be used by "Fully" registered users.

The following is an example of the usage:

 Dim cObj as object Set cObj = CreateObject("MEFilterAPI.Config") cObj.DomainName = "" cObj.AreaName = "Gap Filter" sValue = cObj.LoadSetting("GapFilterNotifyFile", "Default Value") cObj.SaveSetting "GapFilterNotifyFile", "New Value" set cObj = nothing

The full list of functions are:

AreaName: Sets or returns the config area name.

DomainName: Sets or returns the domain name. Set To blank to get/set global settings.

IsAPIEnabled: Returns if the API is enabled for the system.

IsConfigAvailable: Return if registry config is available for the domain. This is based on the "Installed" registry key.

LoadSetting: Gets a specific setting from the registry.

SaveSetting: Saves a specific setting to the registry.

Will this slow email delivery down ?

Thu, 06 Aug 2009 00:00:00 GMT

Yes it will and the more options you have enabled the longer it will take to process each email.

How do I configure 'Domain Specific' settings ?

Thu, 06 Aug 2009 00:00:00 GMT

The Message Splitting option MUST be enabled.
For each domain that you want specific settings, create a directory in the "DomainConfigPath" for the name of the domain eg "MyDomain.Com"
For each function you want to override, place a copy of the file (config files and email notification templates) in to the directory.
If a setting from the MEFilter.Cfg file needs to be overridden, place a MEFilter.Cfg file in the same directory and add the required settings.
NOTES:

Domain specific settings from SpamPhrases, WhiteLists etc, are processed in addition to the standard files, NOT in replace of them.
Settings from MEFilter.Cfg will override the settings from the main MEFilter.Cfg file.
If a remote control Email and Password are defined for a domain, it will work in addition to the default remote control settings.
Any remote control commands sent to a domain defined email address work on the domain specific configuration files.

MEFilter as a MailEnable Filter

Thu, 06 Aug 2009 00:00:00 GMT

Heres a 'Quick & Dirty' filter setup guide:

- Open Mail Enable console/MMC snapin and navigate to 'Mailenable Management' > 'Messaging Manager' > 'Filters'. You should see a filter in there called 'AntiVirus', but dont worry if its not there.

- Right click in the right-hand pane and select 'New' > 'New Filter...'. Name the filter 'MEFilter' or something like that.

- A new filter called 'MEFilter' should now be in the list. Right click on it, and select 'Manage..'. A new window called 'Filter Management' pops up.

- In the pop-up, make sure 'Use standard criteria' is selected. Scroll down the list of 'disabled/enabled' items until you see 'All Messages - Process this filter actions for all messages' and double click on it. Select 'Enabled'. It should now show was enabled in the list.

- At the bottom of the pop-up click the 'Add Action' button, and then scroll down the resulting list and select 'Execute Application', then 'OK' it, which reveals another window.

- In this window make sure 'Enabled' is ticked, then in the 'Application to execute:' textarea enter the full path to MEFilter.exe. For example: "D:\Program Files\Mail Enable\MEFilter\mefilter.exe". In the 'Parameters:' textarea enter "[ID] [CONNECTOR]" (without the quotes), then 'OK' the window.

- Make sure that 'Execute and application' is ticked in the 'Actions' pane of the 'Filter Management' window, then close it.

Now ME should run MEFilter each time a message is processed.

To check its working you should start to see stuff land in the 'Holding' area, provided you have 'Enabled' at least one form or filtering in the MEFilter console settings (i suggest enabling 'Spam Filtering' with defaults first of all). You have to DOUBLE CLICK on the holding folder by the way to see subfolders. If theres nothing look at your MTA logs, available from within the ME snapin under 'Servers > localhost > Filters > Mail Enable Message Filter > Logs > Filters', or through the filesystem in the ME logs directory. There should be an event in the latest 'MTAFILTER-Report-??????.log'