How to block emails with no recipient or Empty To: field RSS Back to forum
@gary.bonebright: I think I figured this out. I added to the "Keyword Blacklist" a new expression that looks at the email_header. Then under the Filter expression Tab added keyword/regular expression: "To: undisclosed-recipients" as simple text. I hope this works and will not cause me issues.
@gary.bonebright:
emails have two types of addresses: the SMTP (envelope) addresses and the MIME addresses:
http://vamsoft.com/support/docs/knowledge-base/sender-different-in-outlook-and-orf
as Jason suggested, you should add a Keyword Blacklist expression which can look into the MIME header to check the MIME addresses, though instead of a simple text expression, I recommend using a regular expression:
1. Start the Administration Tool and connect to the local or remote ORF instance
2. Navigate to the Blacklists / Keyword Blacklist page
3. Click New, select search scope Email header (raw MIME)
4. Select the Filter expression tab, set the expression type to regular expression and enter the following expression:
.*^To:([^\r\n]*undisclosed-recipients:[^\r\n]*)?\s*$
5. Click OK and save the configuration to apply the changes (Ctrl + S)
I keep getting message with the to filed blank. I belive the spam sender is using the BCC field to accomplish this. How can I block this. The message header says the the email is sent to "To: undisclosed-recipients". I want to block these please help.