How to identify which messages have been scanned by SMTP Prevent

Products

• Data Loss Prevention Network Prevent for Email

Issue/Introduction

You have an SMTP Prevent server and you need to confirm whether individual messages have been scanned by the server, even if no incident was detected.

Resolution

The default behavior for SMTP Prevent is to add a header field to every message that passes through the system. There are two server settings that control this:

RequestProcessor.DefaultPassHeader contains the header value to add to each message. The default value is: X-Cfilter-Loop: Reflected . You can change this value; however, the SMTP convention is that customized headers should begin with "X-" for compatibility reasons.

RequestProcessor.AddDefaultHeader is either true (default) or false. If true, the header in the field above will be added to each message.

These settings are located in the Server Settings screen, and are configured on a per-server basis. For example, by entering a different value for each prevent server, you can then determine which server scanned a message from the header value.