Quarantine reports are useless with RETURN TO rather than FROM
I have reported this in the past... and maybe others are on cruze control or dont care.. or havent seen a REAL quarantine report... but your current QUARANTINE report from the SG box is absolutely useless as it is written. Please take the time to read this instead of just waiting on votes. This is a real problem.
Currently the quarantine for both XG and SG units records and shows the mail header field 'RETURN TO' as the FROM address in quarantine and mail log screen. In many cases, this makes the interpretation of those emails impossible prior to releasing to the mail client.
For example... a LOT of bulk mail (even if coming from a known vendor) now included information to see if an address is valid. They add inforation to the RETURN TO field such as 'bounce-20_html-12235547.....' and may or may not have the actual FROM address included. This makes a VERY long and frankly useless FROM showing in the quarantine and mail logs. With only this shown, in some cases emails must be released just to see IF they really are good or not because the subject does not have enough information.
Other SPAM products on the market uses the 'FROM' field for that which in the above case might be 'firstname.lastname@example.org'. Well we recognize CCH as a valid vendor so then we might release... or then look at the subject and release... in either case... better information. Even if its a spoofed address.. it will show up in no worse information than the 'bounce...' info. Any usually MUCH better information.
I realize when these were designed, maybe the RETURN to was often the same as the REPLY TO header fields. I dont see that in todays email world. 80-90% of the mails caught by our quarantine have a useless 'RETURN TO' field and a valid 'FROM' field
I have screen captures to illustrate but cant attach them here. Contact me for examples. These examples show the exact emails that come from another SPAM filtering company that use FROM as useful information. (we are testing both simultaneously)
If not a direct change.... allow the option in the setup to select FROM or RETURN TO. Then the user can decide. It would be the same number of fields... just another one that is already available for use.
I could send screens to show you if there was a way to attach them here. I know you are coming out with a new release... please take time to look at this. I
Stafford Fields commented
IF interested pls give me a place to send some screen prints of this issue. It REALLY is an issue.