Moving pre-tagged spam to ($JunkMail)

Hi all.

I want to automate the “move spam to $junkmail” process in some way on my users mailboxes.

Our incoming mail is already tagged with an X-Spam-Status header (X_Spam_Status field).

I’ve read I can either rely on a “before new mail arrives” agent, or go for an address book template rehaul as described in the acclaimed DominoPower article (http://www.dominopower.com/issues/issue200312/00001158001.html).

The agent works fine in my own mailbox, and I’ll have no problem deploying it since to my 1300 mailboxes since we’re already using a customized mail template, and none of the mailboxes has a “before new mail arrives” agent yet (there can be only one…)

The DominoPower method seems much more… powerful, but it also looks like a lot more work, and I’d rather not make changes to the NAB template unless absolutely necessary.

Anyone has some advice about why I should use either way, or any other?

Will using many “before new mail arrives” agents have any impact on server performance?

Does the template modification make any sense in this case, or is it just overkill?

Other pros and cons?

TIA,

Nicolas.

Subject: Moving pre-tagged spam to ($JunkMail)

Nicolas, Are you running a spamassasin based mail gateway or are you using the spamassasin plugin for domino?

Shawn

Subject: RE: Moving pre-tagged spam to ($JunkMail)

I’m test-driving an Ironport C300 appliance.Looks like a well-working product; so far, so good.

Anyway, my questions apply to any antispam solution set up as a front-end SMTP relay.

And I’ve never heard about this spamassassin plugin actually…

Subject: RE: Moving pre-tagged spam to ($JunkMail)

You may want to try this.

http://www.openntf.org/projects/pmt.nsf/ProjectLookup/SpamAssassin%20Integration

Shawn

Subject: Moving pre-tagged spam to ($JunkMail)

For the record, we finally went for a “before new mail arrives” agent.

Whenever the incoming message is supposed to be a spam, we put it in the junkmail folder remove it from both the Inbox folder and the All documents view.

Then we customized the Junkmail folder :

  • added a “[SPAM]” string before the subject, to make spam messages stand out of other junk mails

  • added a Restore button and a QueryAddToFolder event, so that users can revive a legitimate message

The only issue now is that Ironport won’t disclose the messages’ spam score (it’s stored encrypted – they consider it a trade secret), so we can’t adjust the spam thresold on the appliance based on user feedback as we hoped to, and we’re stuck with the default settings.

They offered to disclose the scores on a message by messages basis and we had very few false postives so far, so maybe it won’t be so problematic.

Here’s the “before new mail arrives” agent code :

Sub Initialize

' Classement automatique du spam présumé



' Le message reçu est:

' - placé dans le dossier Courrier indésirable ($JunkMail)

' - retiré du dossier Courrier en arrivée ($Inbox)

' - exclu de la vue Tous documents ($All)



Dim session As New NotesSession

Dim doc As NotesDocument



Set doc = session.DocumentContext

If Ucase (Left (doc.X_Spam_Status(0), 3)) = "YES" Then

	doc.GetFirstItem ("X_Spam_Status").IsSummary = True

	doc.PutInFolder "($JunkMail)"

	doc.RemoveFromFolder "($Inbox)"

	doc.ExcludeFromView = "A"

	doc.Save True, True

End If

End Sub

NB: We had to flag the X_Spam_Status field as a SUMMARY field, otherwise it can’t be used in the Subject column’s formula.

Here’s the Restore button code :

Sub Click(Source As Button)

' Sortie de document(s) du dossier $JunkMail

'

' Si le champ ExcludeFromView existe et contient "A"

' (message classé automatiquement par l'agent "Filtre anti-spam"),

' on retire cette valeur.



Const EFV = "ExcludeFromView"

Const ALL = "A"



Dim session As New NotesSession

Dim coll As NotesDocumentCollection

Dim doc As NotesDocument

Dim v

Dim uiw As New NotesUIWorkspace



Set coll = session.CurrentDatabase.UnprocessedDocuments

Set doc = coll.GetFirstDocument



While Not doc Is Nothing

	

	If doc.HasItem (EFV) Then

		v = doc.GetItemValue (EFV)

		If Not Isnull (Arraygetindex (v, ALL)) Then

			v = Fulltrim (Arrayreplace (v, ALL, Null))

			doc.ReplaceItemValue EFV, v

			doc.Save True, True

		End If

	End If

	Set doc = coll.GetNextDocument (doc)

	

Wend



coll.PutAllInFolder "($Inbox)", False

coll.RemoveAllFromFolder "($JunkMail)"

uiw.ViewRefresh

End Sub

And at last, here’s the QueryAddToFolder code :

Sub Queryaddtofolder(Source As Notesuiview, Target As Variant, Continue As Variant)

' Sortie de document(s) du dossier $JunkMail

'

' Si le champ ExcludeFromView existe et contient "A"

' (message classé automatiquement par l'agent "Filtre anti-spam"),

' on retire cette valeur.



Const EFV = "ExcludeFromView"

Const ALL = "A"



Dim coll As NotesDocumentCollection

Dim doc As NotesDocument

Dim v



Set coll = Source.Documents

Set doc = coll.GetFirstDocument



While Not doc Is Nothing

	

	If doc.HasItem (EFV) Then

		v = doc.GetItemValue (EFV)

		If Not Isnull (Arraygetindex (v, ALL)) Then

			v = Fulltrim (Arrayreplace (v, ALL, Null))

			doc.ReplaceItemValue EFV, v

			doc.Save True, True

		End If

	End If

	Set doc = coll.GetNextDocument (doc)

	

Wend

End Sub

I hope someone will find this useful. :slight_smile:

Subject: RE: Moving pre-tagged spam to ($JunkMail)

Nicolas,

How can I use this agent if I have a SPAM string , instead of yours that has “[SPAM]”

This looks great , thank you in advance.

-Jeremy

Subject: RE: Moving pre-tagged spam to ($JunkMail)

thanks for this, this is really helpful.

I am trying to modify it to work for us and I can not seem to get it working. I am using Trend Micro that add this in the message header

Field Name: X_TM_AS_Result

Data Type: RFC822 Text

Data Length: 88 bytes

Seq Num: 2

Dup Item ID: 0

Field Flags: SUMMARY

RFC822 Type: TEXT

RFC822 Flags: STRICT

Native Value:

“-<21.093>-<5.0>-<99000>”

RFC822 Header Name:

“X-TM-AS-Result”

RFC822 Header Delimiter:

": "

RFC822 Header Body:

3C 59 65 73 3E

2D 3C 32 31 2E -<21.

30 39 33 3E 2D 093>-

3C 35 2E 30 3E <5.0>

2D 3C 39 39 30 -<990

30 30 3E 0D 0A 00>…

I move the mail to a folder called - SPAM -

I would love any help I can get on this,

TIA