On Tue, Apr 30, 2002 at 07:05:18PM -0700, Surly Zek wrote: > In the example I gave, both myself and q-s think that > the from address listed in the second set of "headers" > (not the envelope from) should receive the warning. > > We both believe that ADDRESS-A should be getting the > warning, yes?
NO! An inline Email content scanner - like Q-S - *must* act like a full MTA does - especially WRT Internet RFCs as to how a MTA should act. MTAs *only* send error reports to the "mail from" envelope address - NEVER the From: line. Therefore that is what Q-S does. It will never be different. Trust me - I've been running Internet mail servers for over 12 years. I think some things become set in stone after that length of time... :-) Your problem is that you have a particular situation where Q-S is erroneously sending out alerts to incorrect addresses. There is nothing that can be done about that. The person who writes the virus controls what is sent - they can always put whatever they like in there... -- Cheers Jason Haar Information Security Manager Trimble Navigation Ltd. Phone: +64 3 9635 377 Fax: +64 3 9635 417
