Christian Purnomo said: > I have a similiar approach, I noticed though that when the email is > copied across to a public folder OR an IMAP folder, the email > header/body is changed with ms-application/tnef. So whatever you feed > sa-learn, it's not going to be effective as the body of the email has > changed since from the original email. > > I get my exchange users to drop all the spams (undetected by > spamassassin) to a public folder and I use imap (exchange is imap > enabled) to retrieve the email from the exchange to my linux box, and > scp && ssh to copy and run sa-learn on the remote mailgateway. > > I am still trying to figure out how to fix this tnef problem, has anyone > experience / noticed the tnef / winmail.dat thing in the email message? > apparently this only happens if the email has been read by a Microsoft > email client who is tnef aware, and it automaticaly changes the email!!! > > CP
Hi Christian, I have a ticket open with MS support on this issue, so far the news is not good. MS has confirmed the problem and the Exchange dev team has said that they will not be able to release a hotfix or patch to change the behaviour of their IMAP/POP3 code due to the change required to fix this possibly causing issues with other pieces of Exchange. Here is what I know of the issue. 1. Email that has only been stored in user mailbox and then pulled from a mailbox via IMAP/POP3 will retain the full headers of the email. 2. Email that is moved into a public folder, then pulled out via IMAP/POP3 will have the headers converted to the TNEF style which removes most X- headers, but does leave the received headers, date/time headers but adds in some of the MS headers including the TNEF. 3. Emails that are moved to a public folder, then moved to a user mailbox, then pulled out via IMAP/POP3 will suffer the same header issues as #2 MS is trying to come up with a work-around for the problem, also in his spare time our developer at work is looking to see if he can come up with a work-around. If I find a better way to pull messages out of Exchange, I'll let everyone know. --matt
