Good news for people who want to use ORF on Windows Server 2008 or 2008 R2 with IIS SMTP (without Exchange): the wait will soon be over :)

We decided to release a new version before ORF 5 (which is expected to be released within a few months).

This interim release will incorporate the following improvements compared to 4.3:

• Support for Exchange 2010 by default (no patch is required)
• Support for IIS SMTP on Windows Server 2008 and Windows Server 2008 R2
• Some bugfixes

The new version will be available within two weeks for everyone with a valid Software Maintenance Agreement.

Lately, we have received many inquiries regarding the filtering of display names in emails. The display name in your email client (e.g. Outlook) is actually the From: field of the MIME email header. The MIME headers can be retrieved by selecting View | Options in Outlook (“Internet Headers”). To check the MIME headers in other clients, please visit this page). Example:

[…]
From: “VIAGRA \(c\) Best Supplier” (email@address)
[…]

You can filter this MIME From: field using the Keyword Blacklist of ORF:

1. Download the filter expression by right-clicking this link and selecting “Save link as…” (XML file)
1. Start the ORF Administration Tool
2. Expand Configuration / Tests / Tests in the left navigation tree and make sure the Keyword Blacklist test is enabled
3. Select Configuration | Import | Keyword blacklist… from the main menu, or navigate to Configuration / Filtering – On Arrival / Keyword Blacklist, right-click in the expressions box and select “Import list…”
4. Select the XML file you downloaded and click Open
5. If you already have some expressions in the list, you will be prompted “Do you want to overwrite…?”. Click “No” (otherwise your current expressions will be wiped out)
6. Press Ctrl + S to save and apply the configuration changes (pre-4.3 users should press Ctrl + U)

And that’s it: the expression above will block any emails, which have “Viagra” in their MIME From: email header line.

However, I should point out that we suggest relying on automated tests of ORF (like DNS and URL blacklists) as much as possible instead of adding keyword filtering expressions every time you receive a new type of spam (and instead of adding the sender to the Sender or IP Blacklists), so you should probably read our best practices guide regarding the recommended configuration if you have received such spam we mentioned above (“viagra” in the display name).

Our own ORF instance at Vamsoft (which is configured according to the guide) caught all of these using automated tests ;)

UPDATE: some of you guys reported that the regex doesn’t work: that’s because the expression above is altered by our blog engine, WordPress (it replaces the double quote characters with left double quotation marks). To work this around, download this XML file from the link and import it to your Keyword Blacklist.

Yesterday, an Avast! anti-virus database update came with a serious bug. We (and others) suspect that by VPS version 091203-0, all applications written in Delphi were being marked as “Win32:Delf-MZG (Trj)”.

ORF was written in Delphi as well, so Avast! might have prevented ORF from filtering emails, or it might have moved ORF the executable(s) to the virus Chest. If you use Avast! and ORF on the same server, please make sure you restore these files as follows:

1. Right click the Avast! icon near your clock and choose Start Avast!
2. Cancel any scans Avast! tries to start
3. Click on the Chest icon: a list of quarantined files will appear
4. Right clicking on any file and select “Refresh all files” to make sure all files in the chest are listed
5. Right click on the files of ORF, select “Restore file” to restored them to their original location and at removed them from the Chest.

The bug has been fixed since by VPS version 091203-1, so make sure you use the latest definition file.

We are happy to announce that Exchange 2010 is now officially supported by ORF.

If you want to use ORF with Exchange 2010, all you have to do is download and install a patch for ORF 4.3, which is available at

http://vamsoft.com/r?mex14p

Please note that earlier versions are not supported, you will need either the registered or the trial version of ORF 4.3 installed. For installation instructions, please consult the readme.txt file.

If you have any questions, feel free to contact us.

The so-called “negative lookarounds” are a lesser known and rather useful feature of regular expressions—for instance, you can use these to construct an expression matching on any text, but “dog” or “cat”. Or, in ORF’s context, match on any email address, but those ending in “@mydomain.org”.

This comes very handy with ORF’s exception lists. For instance, let’s assume you want to turn on Greylisting for just a few selected local recipients. It makes sense, some mailboxes are just too important to suffer the delay that normally comes with the technology. As ORF has a Recipient Exception List for Greylisting, this is something you can do right away—yet I doubt you’d love adding 990 excepted local recipients to the list, just for the sake of enabling Greylisting for 10 non-excepted recipients (and then keep that list up to date, for a 1000-mailbox company). Of course, there is a better solution and yes, it is negative lookarounds.

In this particular case, a negative lookbehind regex will help. This is what it looks like for one email address (a@example.com):

.*(?<!^a@example\.com)$

Both a@example.com and b@example.com:

.*(?<!^a@example\.com)(?<!^b@example\.com)$

a@example.com, b@example.com and c@example.com:

.*(?<!^a@example\.com)(?<!^b@example\.com)(?<!^c@example\.com)$

The first regex will match anything, but a@example.com. The second regex will match anything, but a@example.com or b@example.com. The third one—you already figured it out.

The logic around exception lists gets a little complicated, but how this would translate to human language is: “Make an exception if the recipient address is anything, but a@example.com”. Note that all addresses must be listed in the same regex: if you tell ORF to “Make an exception if the recipient address is anything, but a@example.com”, ORF will look no further, because it already knows the zzz@example.com is excepted, regardless if you have a second similar statement about b@example.com. What you really need to tell ORF is “Make an exception if the recipient address is anything, but a@example.com or b@example.com or c@example.com”, in a single step, using the combination technique above.

Just a few ideas what can be done with the help of this trick:

• To enable certain tests for specific domains or recipents only.
• To disable Recipient Validation for all domains, but one or a few.
• To blacklist all .dat attachments except winmail.dat.
• To blacklist all attachments, except .pdf and .doc ones.

And the list goes on. You can learn more about lookaround assertions at regular-expressions.info and in the PCRE manual.