Welcome to the MacNN Forums.

ghporter · Oct 20, 2007, 05:12 PM

This is something I've done a lot with Outlook-it lets me see if a message is likely to be spam and just looks like it's from some sender that I trust, or actually from that sender. I can't figure out how to do this in Entourage, or if it's even possible. The help wasn't helpful at all.

Any help would be greatly appreciated.

Cold Warrior · Oct 20, 2007, 05:18 PM

how'd you do it in Outlook -- with a rule?

ghporter · Oct 21, 2007, 08:47 AM

Right click on the message, select "Options" and get a little window that let's you do things like change the priority of the message-and access to the full (and I mean FULL) headers of the message.

Cold Warrior · Oct 21, 2007, 10:16 AM

In Entourage 2008 beta, I can single-click the msg to select it, then choose Message > Internet Headers to get a pop-up window showing the full headers.

Don't know if that's Outlook's behavior (I don't have it open right now).

besson3c · 03:50 PM

ghporter and others: it is important to recognize the difference between envelope address and headers. The headers are simply what an email is reporting as the To, From, CC, Bcc, etc. These can easily be forged. In fact, it is even possible to do this via an insecure web form by sending ASCII backspace characters and rewriting these headers.

The envelope address actually shows what servers were responsible for the email transaction. These have some real value since they cannot be easily manipulated.

What I'm unsure of is whether Outlook was scanning header or envelope address info. If the former, this form of analysis is pretty much useless and unreliable. If the latter, how does Outlook know which servers are legitimate mail servers and which aren't? It is definitely not a given that your SMTP server will have a matching domain (or subdomain), or even IP block.

What I would do is put in place a filter based on spam headers, preferably a server side one. If your mail server does server side mail filtering, many anti-spam milters will insert a spam score into the headers. If you don't want to ever see your spam, filter based on this score and you should be set.

I hope this helps and/or answers your questions...

bbales · Oct 22, 2007, 08:34 AM

Entourage has a preview pane. (You set it so the list of messages is on the top, with a preview pane below. THen you can click on the message and see the whole thing, but you're not actually opening it.) Is that what you mean or are you looking for something different?

ghporter · Oct 22, 2007, 09:17 AM

I'm talking about REAL headers (Entourage calls them "internet headers"), reporting the actual source (as far as can be had) of an email, its progress from server to server, and so on.

Previewing a message may mark it as read, and may thus report a "read" status to the sender, which is precisely why I don't want to open the message in the first place. Unread messages don't update spammers' databases, and the spammer tends to just give up on that address after a little while. All the other email clients I know of that offer a preview typically (maybe always) "open" the message enough for it to report being read to the sender (sometimes even if you have set a preference to NOT reply to read receipts). Again, I really don't want any data going back to spammers when I'm probing a suspect message. In Entourage, when you open a message and select View > Internet Headers, you get the headers in a pane at the top of the message window. But the message is still open...

Cold Warrior · Oct 22, 2007, 10:17 AM

I turn off remote images in Entourage, so the web bugs etc won't contact a spammer's server, and I don't allow return/read receipts. Otherwise I don't know how it'd phone home, b/c Entourage won't load other remote media either. The option I described gives me the real headers in Entourage 2008.

Also, viewing those headers in the pop-up window as I mentioned won't mark the message as read -- assuming you're not using a preview pane, which marks it as read when it loads the message to display on the bottom or on the right.

ghporter · Oct 22, 2007, 04:09 PM

Originally Posted by Cold Warrior

I turn off remote images in Entourage, so the web bugs etc won't contact a spammer's server, and I don't allow return/read receipts. Otherwise I don't know how it'd phone home, b/c Entourage won't load other remote media either. The option I described gives me the real headers in Entourage 2008.

Also, viewing those headers in the pop-up window as I mentioned won't mark the message as read -- assuming you're not using a preview pane, which marks it as read when it loads the message to display on the bottom or on the right.

Unfortunately, that method doesn't work with Entourage 2004... I keep remote images off, and don't preview them, but I just can't see the headers without opening the message. Darn it!!!

Nivag · Oct 22, 2007, 05:35 PM

Doesn't view Source in the View menu do what you require? I've just tried it on an unread message and it didn't change it to read.

ghporter · Oct 22, 2007, 06:41 PM

By golly it does look like it! I hadn't tried that one-the "view source" paradigm of web pages must have convinced me that it wasn't right. But it looks like it certainly is. Now if I can be sure it doesn't do any reporting of any kind, I'll be glad. I'll do some tests...