Skip to main content

LevelBlue Completes Acquisition of Cybereason.  Learn More

LevelBlue Completes Acquisition of Cybereason.  Learn More

Services
Cyber Advisory
Managed Cloud Security
Data Security
Managed Detection & Response
Email Security
Managed Network Infrastructure Security
Exposure Management
Security Operations Platforms
Incident Readiness & Response
SpiderLabs Threat Intelligence
Solutions
BY TOPIC
Offensive Security
Solutions to maximize your security ROI
Operational Technology
End-to-end OT security
Microsoft Security
Unlock the full power of Microsoft Security
Securing the IoT Landscape
Test, monitor and secure network objects
Why LevelBlue
About Us
Awards and Accolades
LevelBlue SpiderLabs
LevelBlue Security Operations Platforms
Security Colony
Partners
Microsoft Security
Unlock the full power of Microsoft Security
Technology Alliance Partners
Key alliances who align and support our ecosystem of security offerings
Loading...
Loading...

HOWTO: Generate administrative notification for messages deadlettered as "Malformed Mime"

Expand / Collapse


This article applies to:

  • Trustwave MailMarshal (SEG)
  • Trustwave ECM/MailMarshal Exchange 7.X

Question:

  • Why do Malformed Mime messages not generate notifications?
  • How can I be notified when messages are deadlettered as Malformed Mime?

Issue:

By default, messages that are deadlettered with a deadletter classification of MalformedMime do not generate administrative notifications. This behavior differs from the behavior of other deadletter actions.

This is a deliberate decision. Most messages deadlettered due to malformed mime are spam. There can be large numbers of such messages.

A side effect is that email administrators are not informed in rare cases when an important message is deadlettered for this reason.

A Registry entry has been added to allow configuration of this setting.

Procedure:

Before applying this change in MailMarshal (SEG), consider using Deadletter Rules.

 

By creating an appropriate Windows Registry entry, you can cause SEG or ECM to generate administrative notification email for each message deadlettered as "Malformed Mime."

Warning: Using the Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Trustwave cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Make sure that you backup your Registry prior to making any changes.

To create the Registry entry:

  • In MailMarshal 10.0 and above, open the Management Console and navigate to Advanced Settings. Add a new value:
    • Name: Engine.NotifyMalformedMime
    • Type: Boolean
    • Value: True (Selected)
  • In MailMarshal 8.X and below, and ECM, open the Registry Editor on the Array Manager. Within the base registry key, navigate to \Default\Engine
    • In version 8.X: HKEY_LOCAL_MACHINE\SOFTWARE\Trustwave\Secure Email Gateway\Default\Engine
    • For information about the registry location for each version, see article Q10832.
    • Enter the value as a new DWORD value named NotifyMalformedMime with value 1.
  • Save your registry settings or configuration settings.
  • Commit the configuration changes and restart the MailMarshal Engine service on each node.

Notes:

  • Ensure that an appropriate email address has been configured to receive administrative notifications (on the Notifications tab of Server and Array Properties).
  • MailMarshal supported versions also offer Dead Letter Rules. This functionality provides an alternative way of handling deadletters.

 


To contact LevelBlue about this article or to request support:


Rate this Article:
     

Related Articles



Add Your Comments


Comment submission is disabled for anonymous users.
Please send feedback to Trustwave Technical Support or the Webmaster
.