Copy BCC's messages

[Acciari_ironport]

I have a doubt,

I tried a lot how to find a way to solve this "problem":

Basically, there is a necessity of copying(or quarantine e.g.) all inbound messages that uses the header BCC (Blinded Copy Carbon).



The problem is that the log shows:

Mon May 26 22:34:25 2008 Info: Message done DCID 19 MID 23 to RID [0] [('to', '"Sergio Salgado" <salgado>')]

When the received message uses the field BCC, the log appears "to" instead of "bcc" or anything diff.
so... I can create a filter to attack this...


Anyone can help me ??

Thanks a Lot,

Rafael Acciari

[bfayne_ironport]

bcc is not a 'header'. It is actually, the specific lack of a header.

When a message is addressed to an envelope recipient without the To: header (or any other header) showing the address, that is a bcc. It is used for many legitimate purposes where recipients don't need to know who else recieved that message. It's very commonly used in mailing lists. And of course, abused in many inventive ways.

To capture that with a filter, you might want to test that the envelope recipient was in the To: header, and NOT quarantine that, but quarantine everything else.

Something like this may work.
if (rcpt-to == $Header['To'])
{
deliver();
}
else
{
duplicate-quarantine('Policy');
}


I haven't tested it, so YMMV.