This article applies to:
- Trustwave MailMarshal (SEG)
- Trustwave ECM/MailMarshal Exchange
Symptoms:
- A mail loop occurs after setting up an auto forward rule.
- Thousands of looping messages are queued in MailMarshal.
- An auto forward rule has been set up to forward messages back out through the MailMarshal SMTP gateway.
- An auto forward rule was set up to forward messages from an internal mailbox to another mailbox protected by MailMarshal Exchange.
- The looping message is a MailMarshal e-mail notification using the variable {LastTextCensorRuleTriggered}.
Causes:
One possible reason for the mail loop is that a message was triggered on a TextCensor script rule, which sent out an e-mail notification. The e-mail notification template contained the variable, {LastTextCensorRuleTriggered}, which resolves to the text that caused the original message to trigger on the TextCensor script rule.
The e-mail notification is sent to the internal mail box and the auto forward rule forwards the message to the mailbox or external e-mail address (and therefore, it is processed by MailMarshal).
However, when the e-mail notification is processed through the MailMarshal rules, it triggers on the TextCensor script rule (because it contains the variable, {LastTextCensorRuleTriggered}). You should be able to see what rule the message triggered on by looking in the Mail History screen in the MailMarshal Console.
The result is that the message is quarantined and a new notification is sent to the internal mail box. The auto forward rule then forwards the notification again, which triggers on the TextCensor script rule, and hence a mail loop occurs.
Resolution:
There are two things you can do to help prevent these sorts of mail loops where auto forward rules relay e-mail through MailMarshal.
- Preferred solution, present in the default configuration of recent versions: You can make use of negative weightings in a modified script, which looks specifically for key words used when the {LastTextCensorRuleTriggered} variable is triggered. MailMarshal will then overlook the "offending" word or phrase - but only when used in a notification. Add the following phrase to your script as the first line. It should have a maximum (-100) negative weighting. (In some older versions you may need to use the "sort list" button to ensure correct evaluation).
"Script" FOLLOWEDBY "Triggered" FOLLOWEDBY=2 "Expression:"
- You can remove the variable, {LastTextCensorRuleTriggered}, from any e-mail notification templates. This is effective, but the downside is that the "offending" word or phrase no longer gets presented in the notification to the user.
- This article was previously published as:
- NETIQKB29296
- Marshal KB241