Back to Community Threads
12
Finding users that forward to AOL
Idea shared by SmarterUser - 6/3/2015 at 7:09 AM
Proposed
Is there a way to see which users are forwarding to AOL?  After migrating our AOL-whitelisted server to a new IP, we are back to being rate-limited, and I would like to clear this up without blacklisting the AOL forwards.
 

18 Replies

Reply to Thread
1
Is there not a way to find out which users are forwarding their mail to AOL?
4
This would be a useful report. Say, a report that shows which accounts are using forwarding and what the forwarding destination is.
1
Employee Replied
6/5/2015 at 1:47 PM
Employee Post
Hello.  This isn't contained in a specific report.  But you could search your delivery logs for "has completed (Forwarded Delivered)"
That means that a message has been delivered to a users inbox and then forwarded on.
Now perform a search on the session number in the beginning of that log entry [#####].
The forwarding to AOL will occur within that same session, so you should be able to find it that way.
0
If you want to prevent forwarding to aol.com simply add aol.com to your Rouuting | Forwarding Blacklist setting.
Thanks, -Joe
0
I am looking for all the users on the server who are forwarding to AOL. Searching logs as you suggest is not viable.
0
As I said, I do not want to blacklist the AOL forwards. I just want to discuss this issue with the users who are doing this. There's just no way to figure out who they are.
0
This is exactly what's needed.
1
This is obviously a feature request and should be adjusted to reflect that.
1
Hi Agree!
2
I tried Rods suggestion and it worked, I now know all the forwarded recipients, clever search Rod! I narrowed it a bit more to @aol.com has completed (Forwarded Delivered)
Remember kids, every time a spam message gets blocked, a nerd gets their glasses. spamhurts/July 15
1
Glad you got it sorted.  But i also agree that this is really a feature request. In fact i was going to post it but got side tracked catching up on the forum. 
 
In the domain user list, you can see the users but it would be nice to be able to see who is forwarding out of a domain. Or a separate report too.  Some domain owners do not want their users forwarding out of the domain (to anyone, not just aol) and deleting content from the mailbox. This gets into ownership issues too, not just spam.  Once a user forwards mail from a company or non profit domain to their personal email account, the organization may need a court order to get the email back. (We are going through this right now with a client org)  It would be nice to see if anyone has forwarders set up.
www.HawaiianHope.org - Providing technology services to non profit organizations, low income families, homeless shelters, clean and sober houses and prisoner reentry programs. Since 2015, We have refurbished over 11,000 Computers !
1
Employee Replied
8/13/2015 at 11:02 AM
Employee Post
Thanks for all the feedback. I've changed this thread from a question to a Proposed Idea, with the proposal to create a report that shows the users with a forwarding address and the destination.
 
Thanks!
0
Thanks Andrea.
We had a problem with MSN because a lot of users forward to hotmail, and since they forward a strong spam wave we had blocked to MSN network. It Will be nice to have some development in this forward area. Like other write: Possible to disable forward to outside the domain, know the users that forward their email, etc.
0
This would be a great feature.  Currently we have to track forwarding manually.
 
 
1
This DELIVERY LOG search works like a charm: "@aol.com has completed (Forwarded Delivered)"  omit the quotes.
 
Here's an example of a complete line for a forwarded message:

"[2015.08.24] 14:17:05 [08578] Delivery for bounce-1458345_html-876155099-26141440-112346-0@bounce.email.REDACTED.com to REDACTED@AOL.COM has completed (Forwarded Delivered) Filter: None"
 
Here are the results of such a search:
 
Search for forwarded messages in DELIVERY LOGS, without any specific domain selected.
Results redacted for user privacy.
 
You can then look at the entire line for the AOL.COM forward to see who is forwarding to AOL.COM e-mail addresses and address the issue with them.
 
Alternatively, you can use the search feature [CONTROL F in most browsers] you can search the results of the delivery logs WITHOUT the SHOW RELATED TRAFFIC box checked, it will show each forward on a single line and make it very easy for you to use FIND in your browser window for all incidents of @AOL.COM.
 
Using browser's FIND FUNCTION to search for AOL.COM forwards in results of forwarded messages

The data used above is from a search I just ran of our SmarterMail server's delivery logs, which go all the way back to 1 January, 2006.  The search took our Windows Server 2012 64 bit server less than 2 minutes to find every occurrence, of every forwarded message, which occurred in the delivery logs during the last 10 years. 

NOTE: We are running SmarterMail 14.4.5802 ENTERPRISE edition.  Recent versions of SmarterMail allow searching through multiple dates of logs simultaneously, which is a very good reason to upgrade to the most recent version.

Because of our healthcare and government customers, we keep our logs indefinitely - never deleting them.  This is for both compliance purposes and also makes queries like the one demonstrated above extremely easy to run,
Bruce Barnes ChicagoNetTech Inc brucecnt@comcast.net Phonr: (773) 491-9019 Phone: (224) 444-0169 E-Mail and DNS Security Specialist Network Security Specialist Customer Service Portal: https://portal.chicagonettech.com Website: https://www.ChicagoNetTech.com Security Blog: http://networkbastion.blogspot.com/ Web and E-Mail Hosting, E-Mail Security and Consulting
0
Thanks for the detailed write up. I understood the above explanation, it would just be nice where you could schedule a email report that shows the current forwards and their destinations. Where you did not have to manually decipher logs.
0
There is no such report available at this time.
 
As noted by Andrea Rogers of SmarterTools, she has changed your original post to PROPOSED.  This will urge members of the SmarterMail online community to "vote it up," if they have a similar interest or need, but it does not guarantee that the feature will be introduced into a future minor or major release any time soon.
 
Your best bet, at this time, is to use the method suggested by Rod Lasky, again of SmarterTools, and search for "@aol.com has completed (Forwarded Delivered)".
 
I showed you the easiest method to do so in my post above.
Bruce Barnes ChicagoNetTech Inc brucecnt@comcast.net Phonr: (773) 491-9019 Phone: (224) 444-0169 E-Mail and DNS Security Specialist Network Security Specialist Customer Service Portal: https://portal.chicagonettech.com Website: https://www.ChicagoNetTech.com Security Blog: http://networkbastion.blogspot.com/ Web and E-Mail Hosting, E-Mail Security and Consulting
0
I understand that. That is why I said it would be a nice feature in my original post. Just making and comment and up voting to get it more visibility...
Back to Community Threads

Reply to Thread

Related Knowledge Base Articles

Recommended SPAM SettingsSmarterMail > Antispam and Antivirus
Unexpected Sync Behavior with Outlook and IMAPSmarterMail > Troubleshooting
Find a Compromised AccountSmarterMail > Troubleshooting
500 Error After Upgrading to the Latest BuildSmarterMail > Troubleshooting
Set up Autodiscover for SmarterMailSmarterMail > Installation and Configuration