Email Pre-processing, Fixes in IMF Tune Update

A new IMF Tune update is available for download, bringing more functionality and some important fixes.

The email pre-processing functionality announced earlier, is the most significant addition delivered in this update. This is being surfaced through four Advanced Rule conditions, ticking off some highly requested improvements.

Recipient Email Conditions

The conditions Recipient email alias is in subject and Recipient email alias is in body, are very effective at targeting a common spam trait.

Most organization assign email addresses using schemes of the type:
name.surname@domain.com

IMF Tune matches the first segment of the email address (name.surname) by applying whole word matching. For example this raises a match:
Hi name.surname, how are you doing?

Whereas the complete email address in this email signature doesn't:
Best Regards,
Name Surname
name.surname@domain.com

When using these conditions keep in mind that:

1. These conditions depend on the email address scheme in use. A simple address scheme of the type name@domain.com would give rise to many false positives.

2. Being part of the Advanced Rules interface, these conditions can be combined with additional conditions/exceptions.

   As an example consider an organization whose addresses largely follow the scheme name.surname@domain.com but also has a few addresses of the type name@domain.com. The recipient alias conditions can be combined with the exception Body or Subject contains words. This exception would then include all the names appearing in addresses of type name@domain.com

Digits in Sender Addresses

The condition Total digits in sender address is within range, targets low value email addresses. Digits are an indication that an address was generated automatically. Spammers use this trick to quickly create unique addresses.

Users relying on free email services sometimes also use digits, especially when having trouble finding a unique address. On the other hand, business entities rarely use digits, since these make them look less professional.

This filtering condition is fine-tuned by specifying the digit count threshold. Organizations that deal exclusively with business clients won't see many legitimate senders with digits in their emails. Thus they can afford a low threshold, maybe blocking addresses with 3 or more digits. Other organizations with a broader pool of senders (such as Universities) may want to be more lenient and allow for more digits.

NULL Senders

NULL sender addresses are used in Delivery Status Notification (DSN) emails. The most well-known DSN type is the Non Delivery Report (NDR) sent when an email fails delivery.

The Is NULL sender condition is useful whenever we want to create rules targeting these emails. An NDR spam wave could be dealt with by applying this filter to raise the spam rating of NULL sender emails.

In addition, by combining multiple conditions we can target specific DSN sub-categories. This would require us to better understand DSNs. Check the article Understanding NDRs and other DSN Reports for more details.

Fixed - "Power Shell not found!" Installation Error

Occasionally we are encountering problems with servers having missing/incorrect registry information under the Power Shell registry hive. These servers would still have a well-functioning power shell. We encountered this problem on Windows 2019 but the same issue might arise on earlier Windows server versions.

IMF Tune depends on Power Shell for installing some of its components. In this fix we are replacing Power Shell detection, such that to allow IMF Tune to proceed with the installation. Any serious Power Shell problems are now caught by the installation further down the line.

Fix - Uninstall Not Removing IIS ASP.NET Application

When the IMF Tune Moderator/Reporting component is installed on a Windows 2019 server, a subsequent uninstallation would not remove the ASP.NET application components from within IIS 10. This update includes the necessary fix for these components to be correctly removed.

If running an earlier version of the Moderator on Windows 2019, you may encounter this problem on upgrading. In that case just go ahead with uninstalling and re-installing the latest Moderator. The re-installation will perform the necessary cleanup and re-create the components. Subsequent uninstallations will correctly remove the ASP.NET application.

Version Information

This information applies to IMF Tune v8.0 build number 8.0.105.06. If IMF Tune is already installed you can verify the current build number from the configuration interface under the Miscellaneous category.