Generate administrative notification for messages deadlettered as "Malformed Mime"

This article applies to:

• Trustwave MailMarshal (SEG)
• Trustwave ECM/MailMarshal Exchange 7.X

Question:

• Why do Malformed Mime messages not generate notifications?
• How can I be notified when messages are deadlettered as Malformed Mime?

Issue:

By default, messages that are deadlettered with a deadletter classification of MalformedMime do not generate administrative notifications. This behavior differs from the behavior of other deadletter actions.

This is a deliberate decision. Most messages deadlettered due to malformed mime are spam. There can be large numbers of such messages.

A side effect is that email administrators are not informed in rare cases when an important message is deadlettered for this reason.

A Registry entry has been added to allow configuration of this setting.

Procedure:

Before applying this change in MailMarshal (SEG), consider using Deadletter Rules.

By creating an appropriate Windows Registry entry, you can cause SEG or ECM to generate administrative notification email for each message deadlettered as "Malformed Mime."

Warning: Using the Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Trustwave cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Make sure that you backup your Registry prior to making any changes.

To create the Registry entry:

1. On the Array Manager, edit the Registry (10.X: use Advanced Settings in the Management Console)
2. Navigate to the Engine key:
   • In SEG version 8.X: HKEY_LOCAL_MACHINE\SOFTWARE\Trustwave\Secure Email Gateway\Default\Engine
   • In MailMarshal (SEG) 10.X: value names have the prefix Engine. (Engine dot).
   • For full details of the location for each product version, see article Q10832.
3. Create a new DWORD value NotifyMalformedMime
4. Set the value to 1.
5. Commit  Configuration.

To stop the notifications, set the above value to 0 or remove the value entry.

Notes:

• Ensure that an appropriate email address has been configured to receive administrative notifications (on the Notifications tab of Server and Array Properties).
• SEG supported versions also offer Dead Letter Rules. This functionality provides an alternative way of handling deadletters.