> IMail AntiVirus is rejecting infected emails DURING the SMTP > communication? In other words, it doesn't first get accepted (as is > the case with Declude)?
Yes, IMail AntiVirus is able to vector emails through its own virus-scanning daemon during the SMTP transaction. Yet the message bodies are still transmitted in full to your server, just as with Declude: that's the only way to de-MIME messages for scanning. So, for one thing, the transaction does not consume any fewer bytes: the 550 is sent exactly where the closing 250 would be sent for a successful transaction. > If that's the case, then I see this as a major advantage of Imail's > AntiVirus solution. I wouldn't HAVE to worry about the extra message > volume caused by sending out virus notifications (possibly to faked > addresses) and then deal with the bounce messages because they WERE > faked. Ask yourself--or ask your logs--whether cutting down on the message volume you mention is worth the cost of replacing your current, happy, and effective installation of Declude. While you are certainly correct in theory that there would be bandwidth saved, both for successful virus notifications and double bounces, I would be extremely surprised if that volume is going to make a substantive difference for you. (If it is, putting up another offloading IMail server with Declude can STILL be cheaper than IMailAV!) > Instead the SENDING mail server would know that the mail was never > ACCEPTED and that server is much better suited to notify the TRUE > sender. No, Declude has as much access to the "true" sender (ha-ha), that is, the envelope sender, as the previous-hop server. Neither is going to be any better at reaching a non-existent address. Furthermore, one compelling use case: if virus writers use the spammers' technique of From: and To: being identical, there is actually MORE bandwidth generated by blocking viruses during the SMTP transaction...since, if generated by the previous-hop server, the Postmaster message will have to go *back* over the same wire, rather than staying local to the IMail machine. > As much as I love Declude (and I would want to keep it), I'd see > that as the "right" way of blocking unwanted email and I would > finally give Imail AntiVirus a serious consideration. Well, that "right" way is a proprietary vectoring hook built into IMail 7 specifically for Symantec, which could not be used by a non-allied developer. Scott's products could not use this method; I'm sure he would explore it if he could. And one shouldn't forget Scott's mastery of MIME, advance knowledge of new infection methods, pre-scanning algorithms, and support responsiveness, which continue to be persuasive, even to those (like me) who have long been aware of this admittedly cool feature of ImailAV. ImailAV's price point just makes it hard to take any feature all the way to a sale. -Sandy Please visit http://www.ipswitch.com/support/mailing-lists.html to be removed from this list. An Archive of this list is available at: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Please visit the Knowledge Base for answers to frequently asked questions: http://www.ipswitch.com/support/IMail/
