Filtering New eMail Using Lotus Notes Rules

• Introduction
• How to Create a Rule

• An Examples of  Spam-Filtering Rule

• How to Manage Rules

• Example of the Ruleset for Spam Filtering

• How to Use Rules to Delete False Delivery Failure Reports

• How to use rules to delete virus warning messages

• Ghost Rules and Lotus Notes Rules Mess

• Frequently Questions (FAQ)

• Supplement 1: A Note on Email Addiction

Introduction

You can use mail Rules (available for version of Lotus Notes starting with 5.0)  to have Notes act automatically on new messages you receive that meet certain conditions. This give you a possibility to create your own spam filters. For example if you use gateway spam filter are in the marking mode you need at least one rule that moved all messages that have prefix [UCE] into the spam folder.

You can also create a rule that checks for messages from a certain sender or that contain a certain subject and have Notes automatically move the messages to a certain folder. 

Please never move any messages to the folder Trash unless you tested the rule using other folder (for example a folder Spam). Even in case of nasty mails I  recommend to create a rule that moves the messages into the folder Spam and see if the rule is working correctly for a week or so, and only after that to change the folder to Trash.

For most situations Spam is a better target folder, because rules that use Trash folder as a target can mistakenly delete some useful mails in you Inbox, if you are not careful in selection of the filtering criteria (see below). 

You can also create additional folders like Newsletters,  Important  etc and specify rules that move some type of mail to those folders. But this adds to the complexity: never create more then three additional folder, it became difficult to check them all and you can easily overlook an important message.

Notes stores the mail rules you create in the Rules folder in your mail database. If you do not have this folder please call helpdesk: they have a special procedure to enable them. The most typical example of the rule, the rule that moves all messages with the prefix [UCE] to the Spam folder is explained step-by-step below. This rule is needed if you switched to the marking mode.

After that you can go there to add new rules as well as edit (but not delete rules: there is bug in the current version of Lotus Notes) old rules. You can also change  rules order so that one rule has priority over another or turn some rules turn off temporarily, when you don't want to use them. Please use this turn off feature instead of deletion.  

Again, please do not delete rules just disable them (if you want to delete the rule it's much safer to disable it first and then delete). After you disable the rule you can use it for creation of any new rule later. Never create more then five-seven rules: complex rule sets are prone to side effects and you can easily misplace or delete an important message.

If you delete the rule without disabling it first, you can get so called "ghost rule": the rule is deleted from you view, but is still active in your mail profile and redirects mail.

To deal with spam you need to create a series of rules that check for messages a certain sender,  or contain a certain works in the subject or in the body.

Note 1: We have special Lotus Notes support group that is eager to help you with all Lotus Notes questions. Computer security is probably not a right  place to ask any questions about Lotus Notes. This information is provided here, because this is a gray area that falls between two groups responsibilities. NTI/V took an initiative to introduce Spam filtering on the mail gateway, but due to the inertia the group that pioneered solution of some problem usually inherits all the questions, even if they are actually related to desktop Lotus Notes client :-). Please note that I wrote this document partially to avoid such questions ;-)

Note 2: Lotus Notes 5 uses rules in the order in which they appear from top to bottom, so you can move the rules you want to have priority closer to the top. This way, if a new message you receive meets the criteria of two different rules, the rule that's closer to the top acts on the message first. (This is particularly important for spam rules). But you generally never should make a set of rules too complex and it is wise to limit yourself to five-seven rules.

Note 3: Please note that often e-mail glut is a self-inflicted wound: you need to very selective in subscription to bulleting and mailing lists. I suffer myself  from subscriptions to too many bulletins, subscriptions that I now almost never read, but that still clutter my Inbox ;-). Please see E-mail Addiction

How to Create a Rule

(using the rule that moves all messages
containing prefix [UCE] in the subject line as an example)

First you need to locate Rules folder. If  Rules are absent in the Tools folder (see below), you probably are using old Lotus Notes 4-derived  template and you need to call the helpdesk and ask how to update to more recent Lotus Notes 5 template.  Only Lotus Notes 5 templates contains rules.

Generally you can use mail rules to perform actions on new messages, based on the one or more conditions. The message conditions you can choose are:

1. Sender
2. Subject
3. Body (useful for blocking porno messages)
4. Importance
5. Delivery priority
6. To
7. CC
8. BCC  (you can delete all BCC messages coming from domains other than BASF).
9. To or CC
10. Body or subject  (useful for blocking porno messages)
11. Internet Domain (useful for blocking whole domains, see FAQ for details)
12. Size (in bytes) (useful for blocking infected messages. For example messages generated by Klez.H are between 100K and 200K)

For example let's discuss how to create the rule that moves all messages with the prefix [UCE] in the subject line to the Spam folder you need to select the condition "Subject".

First you need to locate the Rules folder Click on it and then Click "New Rule."

1. To specify "Conditions," select a part of messages to check ("subject" for our example), then select a state ( "contains" in our example), and type the criteria to check for ([UCE] in our example)
    
2. Click Add.
    

3. Under "Specify Actions," select "move to folder," then click "Choose Folder" and select a folder Spam.
    

4. Click "Add Action."

   (you actually can remove wrong actions, if you specified something by mistake at this step)

    

5. Click OK.

An Example of a Spam Filtering Rule

The following rule automatically changes the importance of all messages from Tom Jenkins to high (which means they are displayed with an exclamation point in the Inbox to catch your attention):

The following rule automatically moves all messages that have the word "status" in the subject from the Inbox to the Status Reports folder unless the subject also has the word "sales" or "project" in the subject:

To Manage Rules

Example of the Ruleset for Spam Filtering

Below is a complex set of rules (ruleset) that demonstrates some capabilities (or luck of thereof) of Lotus Notes Rules. Implementation of Rules in version 5 remains pretty buggy and amazingly primitive for such company as IBM, but we have what we have. The example below uses four folders: Inbox(Regular), Newsletters, Spam and Trash.  The folder Newsletters is used for my mailing lists subscriptions. That means that we will create a ruleset that classifies mail in four categories Inbox (Regular), Newsletters, Spam and Trash.

Please note that it's impossible to filter all spam (and actually this is not necessary), so it is reasonable to have only minimum number of rules in such a set. The most save is to have only one rule that moves mail with the prefix [UCE] to the spam folder. As the set grows larger, the possibility of side effects including deletion of important mails grows. Also if you delete any rule you can create "ghost rules" and your life will become much more miserable then before your jump in spam filtering  improvement.

Some on the rules contain my ID (bezroun) and should be changed accordingly. As you can see we use OR/AND in this ruleset and that might increases flexibility of the filtering. But it remain very primitive and you should go too far with it (as in an example above ;-)

Please keep in mind that the rule that moves to Spam folder any sender that have digits in ID is very effective for removing spam but is a risky one. It is based on my observation the usually corporate IDs do not contain digits. And this is not completely true even for BASF. The rule already contains one exemption (if sender contain the word BASF, his letter will be accepted even if ID contains digits), and it works fine for me. You mileage may vary. Some users probably might benefit from adding an additional exception rules that contains addresses of friends with IDs that contain numbers

Note:  Notes uses rules in the order in which they appear from top to bottom, so you can move the rules you want to have priority closer to the top. This way, if a new message you receive meets the criteria of two different rules, the rule that's closer to the top acts on the message first. (This is particularly important if you have rules that move or delete messages.)

How to Use Rules to Delete False Delivery Failure Reports

If you are sick and tired of false Delivery Failure reports with subjects like "DELIVERY FAILURE: User bickhab ([email protected]) not listed in public Name & Address Book"

you can create an additional rule that checks the subject for this string:

In the action part of the rule you can specify remove option. 

How to use rules to delete virus warning messages

If you are sick and tired of gateway notification messages with subjects like *** VIRUS WARNING: EXECUTABLE ATTACHMENT REPLACED *** you can create an additional rule that checks subject for this string:

In the action part of the rule you can specify remove option.  You might also benefit from the second rule that deletes notification about the blocking that email gateway sends as a separate letter:

Actually this custom filtering can be more flexible and used in other cases and use worms, even those that are not yet detected by the virus gateway.  Let's demonstrate this idea on the same save example as above but assume that virus uses non-executable attachment (foe example zip).  If subject lines vary but the virus message has the same body you can use option  "Body" in the condition of the rule to delete  messages even. In case of W32.Sobig.F. the body of the message send by the worm always contains :

See the attached file for details

or

Please see the attached file for details.

In this case the rule might be:

and action put mail into Spam folder (again remove option is a dangerous choice even if you hate all those messages).

This rule checks the body for  the string "see the attached file for details".  

If you still want to delete email despite considerations outlined above then please use the size of the letter as an additional condition (see below). If the attachment is not replaced (for example it is a zip file) you should use size margins that cover its actual size + average size of the letter.  But in most such cases we are dealing with the executable attachments and they are always replaced on the gateway.  When executable attachment was replaced on the virus gateway, the replacement (a dummy file ) has always the same size and in case of SoBig the letter body plus attachment vary between 4400 and 4500 bytes. This additional size restrictions can be specified using AND clause. In this case the rule should look like:

When:

body contains see the attached file for details

AND size > 4400

AND size < 4500

Ghost Rules and Lotus Notes Rules Mess

Rules were introduced in version 5 of Lotus Note and IBM folks did not fully debug the code before shipping the product to customer  ;-). As our servers and desktop client are still on version 5 you are at the receiving end of this problem. Again, please do not delete rules just disable them (if you want to delete the rule it's much safer to disable it first and then delete). After you disable the rule you can use it for creation of any new rule later. Never create more then five-seven rules: complex rule sets are prone to side effects and you can easily misplace or delete an important message.

The problem demonstrates itself when a user deleted a rule without disabling it first. If you delete the rule without disabling it first, you can get so called "ghost rule": the rule is deleted from you view, but is still active in your mail profile and redirects mail.

You can the following voodoo trick that sometimes help:

• Disable all rules

• Delete your Spam folder

• Close Notes Notes

• Recreate your Spam folder

• Enable needed rules

 Frequently Questions (FAQ)

Q1: What if I don't have a Rules folder?

A: If you are using Notes R5, but you don't see a Rules folder in your mail database, you probably need to update the design of your mail database to the Mail (R5.0) template design. Can the helpdesk.

Q2: I get nasty spam, but the sender and the subject line changes all the time. What should I do?

A: You should probably enroll into the gateway spamfilter. Also can try to filter spam mail from the whole domain: rather than targeting particular sender you can create a rule to move to a designated folder any incoming mail from a particular domain (for example yahoo.com) if you do not want to get mail from this domain at all. To do so:

1. In your mail database, click the Rules folder.
2. Click the New Rule button or choose Actions - New Rule.
3. Ensure the "This rule is" radio button is set to On.
4. In the Specify Conditions section, choose "Internet domain" and "contains" from the drop-down lists.
5. Type the Internet domain in the box next to "contains."
6. Click Add. Your condition appears in the "When mail messages arrive that meet these conditions" section.
7. Choose OR from the AND/OR drop-down list.
8. Type another Internet domain in the box next to "contains."
9. Click Add. Your condition appears in the "When mail messages arrive that meet these conditions" section.

Q3: Can I filter spam based on words in the message ?

A: Yes, but you need to be very careful. You probably have seen many spam mail messages with phrases such as "Get rich quick," or other such language trying to sell you something. You can try to use those typical combinations of words, not a single words.  You can also use Exception to exempt certain senders from the rule, for example all senders from the BASF domain and your friends addresses. That diminishes the danger that a useful mail will be filtered out.

1. In your mail database, click the Rules folder.
2. Click the New Rule button or choose Actions - New Rule.
3. Ensure the "This rule is" radio button is set to On.
4. In the Specify Conditions section, choose "body or subject" and "contains" from the drop-down lists.
5. Type the phrase "get rich quick" (omit the quotation marks) in the box next to "contains."
6. Click Add. Your condition appears in the "When mail messages arrive that meet these conditions" section.
7.  Next to Create, select Exception.
8. Choose "sender" and "contains" from the drop-down lists.
9. Type  "@basf-corp.com" (omit the quotation marks) in the box next to "contains."
10. Click Add. Your exception appears in the "When mail messages arrive that meet these conditions" section.
11. Repeat the same steps for our alias basf.com and any other domain that you want to be exempt.

Q4: I created several rules but they do not work in the order that I want. What should I do ?

A: You can review the full list of conditions and actions in your rule. May be you make a mistake, or  you can make the rule more precise. Sometimes you need to be creative, mixing several conditions and exceptions within one mail rule, for catch a particular type of spam. Never try to catch all spam.  

The most common mistake is the wrong order of the rules. You can change this order using the "Move Up" and "Move Down" buttons. The rules at the top take precedence over rules at the bottom.

You can also create an additional folder Test like the folder Newsletters and use it in the rule to see how it behaves.

Return on the investment in creation of the rules quickly diminishes after five rules or so. Also never use more then three additional folder:  you need to check all of them at least once a day or you can miss an important message that were improperly classified.  For example some people can benefit from the type Unwanted for messages they were subscribed in the past, but no longer interested in, for example jokes lists. Another example of unwanted mail are mails with large attachments (say over 100K), You can also direct them into this folder. That is especially important for mobile users, as for them it is time-consuming to replicate these large messages from Inbox when you dial in to check your mail. You can create a mail rule with a message size condition, perhaps of 100K, so that large messages are moved to a "Unwanted" folder. You can then change your Replication Settings to exclude the "Unwanted" folder from replicating to the local mail file on your laptop PC. You still can  read those large messages when you return to the office.

Q5: How can I delete all those virus warnings ?  I got more then a hundred of them today

A: See  How to use rules to delete virus warning messages

Q6: My Rules started to behave very strangely and arbitrary move mail to the Spam folder. What can I do ?

You are a victim of "ghost rules", rules that you deleted from your view but that are still active in you Lotus Notes profile. This is  a known bug and you should put a ticket to Lotus Notes support to fix it.  See also "Ghost rules"

Supplement 1:  A Note on Email Addiction

E-mail became an integral to corporate life. But for some people it become a real addition. For example Richard Laermer, the CEO of RLM Public Relations, typically fires off 500 messages a day, an electronic blitzkrieg that has moved more than one recipient to beg for relief. Before bed, he switches his E-mail pager to silent mode but never turns it off. That way he can check the display late at night.

The terrifying thought of E-mail messages unanswered has even kept him from enjoying beach-house vacations. "My pager's satellite system doesn't reach all the way to Southampton," says Laermer. "So, twice, I drove 15 minutes west to pick up my E-mail."

As was noted in the paper Email Addiction and the B2B Email Marketer:

This all-too-common behavior has provided rich fodder for "You Know You're Addicted to E-Mail When . . ." lists ("You check your mail. It says, 'No new messages.' So you check again"). But for some users, this problem is no joke.

 "Whether you get addicted to the Internet, to drugs, to gambling, it's all, in my experience, the same thing," says David Greenfield, author of the forthcoming Virtual Addiction: Help for Netheads, Cyberfreaks, and Those Who
Love Them. "When the brain likes something, it wants it again." Whether heavy E-mail users can be formally classified as addicts is a subject of a heated debate. "There are people who overdo things including working, watching TV. There is nothing addicting about work or television," says Ivan Goldberg, a psychiatrist specializing in mood disorders. "But there are people who are so depressed that they'll repeat any activity to blot out the reality they don't want to face."

Heavy computer usage might be a cause rather than a symptom of mental distress. But people who spend marathon stretches at the keyboard writing e-mails often shun face-to-face contact "Opening an E-mail is analogous to pulling the handle on a slot machine," says Greenfield. "Each time you open it, you have a renewed sense of pleasure, of hope, in anticipation." After all, the next message could mean life-changing news from a long-lost friend or a mash note from an office crush. And when it turns out to be just another piece of spam, says Michael Flaherty, a clinical psychologist at St. Francis Medical Center in Pittsburgh, "there's the crash."

The medium also offers wallflowers a sense of power. They savor the safety of facelessness and the time to select their words with care. "What you're dealing with is people who may be socially phobic, who may not want to go out into the real world, and would prefer to be on E-mail because they can be who they want," says Marissa Hecht Orzack, who heads a computer-addiction treatment center at McLean Hospital in Belmont, Mass. Interpersonal relationships fade as these shy types increasingly live online, leading to social isolation.

Because of E-mail's prevalence, kicking the habit can be tricky. The computer is now part of life. You just have to interact with it in a manner where you control it, not it controls you."  Switching off the screen for couple of hours a day never hurts, either ;-)

Etc

Society

Groupthink : Two Party System as Polyarchy : Corruption of Regulators : Bureaucracies : Understanding Micromanagers and Control Freaks : Toxic Managers :   Harvard Mafia : Diplomatic Communication : Surviving a Bad Performance Review : Insufficient Retirement Funds as Immanent Problem of Neoliberal Regime : PseudoScience : Who Rules America : Neoliberalism  : The Iron Law of Oligarchy : Libertarian Philosophy

Quotes

War and Peace : Skeptical Finance : John Kenneth Galbraith :Talleyrand : Oscar Wilde : Otto Von Bismarck : Keynes : George Carlin : Skeptics : Propaganda  : SE quotes : Language Design and Programming Quotes : Random IT-related quotes :  Somerset Maugham : Marcus Aurelius : Kurt Vonnegut : Eric Hoffer : Winston Churchill : Napoleon Bonaparte : Ambrose Bierce :  Bernard Shaw : Mark Twain Quotes

Bulletin:

Vol 25, No.12 (December, 2013) Rational Fools vs. Efficient Crooks The efficient markets hypothesis : Political Skeptic Bulletin, 2013 : Unemployment Bulletin, 2010 :  Vol 23, No.10 (October, 2011) An observation about corporate security departments : Slightly Skeptical Euromaydan Chronicles, June 2014 : Greenspan legacy bulletin, 2008 : Vol 25, No.10 (October, 2013) Cryptolocker Trojan (Win32/Crilock.A) : Vol 25, No.08 (August, 2013) Cloud providers as intelligence collection hubs : Financial Humor Bulletin, 2010 : Inequality Bulletin, 2009 : Financial Humor Bulletin, 2008 : Copyleft Problems Bulletin, 2004 : Financial Humor Bulletin, 2011 : Energy Bulletin, 2010 : Malware Protection Bulletin, 2010 : Vol 26, No.1 (January, 2013) Object-Oriented Cult : Political Skeptic Bulletin, 2011 : Vol 23, No.11 (November, 2011) Softpanorama classification of sysadmin horror stories : Vol 25, No.05 (May, 2013) Corporate bullshit as a communication method  : Vol 25, No.06 (June, 2013) A Note on the Relationship of Brooks Law and Conway Law

History:

Fifty glorious years (1950-2000): the triumph of the US computer engineering : Donald Knuth : TAoCP and its Influence of Computer Science : Richard Stallman : Linus Torvalds  : Larry Wall  : John K. Ousterhout : CTSS : Multix OS Unix History : Unix shell history : VI editor : History of pipes concept : Solaris : MS DOS :  Programming Languages History : PL/1 : Simula 67 : C : History of GCC development :  Scripting Languages : Perl history   : OS History : Mail : DNS : SSH : CPU Instruction Sets : SPARC systems 1987-2006 : Norton Commander : Norton Utilities : Norton Ghost : Frontpage history : Malware Defense History : GNU Screen : OSS early history

Classic books:

The Peter Principle : Parkinson Law : 1984 : The Mythical Man-Month :  How to Solve It by George Polya : The Art of Computer Programming : The Elements of Programming Style : The Unix Hater’s Handbook : The Jargon file : The True Believer : Programming Pearls : The Good Soldier Svejk : The Power Elite

Most popular humor pages:

Manifest of the Softpanorama IT Slacker Society : Ten Commandments of the IT Slackers Society : Computer Humor Collection : BSD Logo Story : The Cuckoo's Egg : IT Slang : C++ Humor : ARE YOU A BBS ADDICT? : The Perl Purity Test : Object oriented programmers of all nations : Financial Humor : Financial Humor Bulletin, 2008 : Financial Humor Bulletin, 2010 : The Most Comprehensive Collection of Editor-related Humor : Programming Language Humor : Goldman Sachs related humor : Greenspan humor : C Humor : Scripting Humor : Real Programmers Humor : Web Humor : GPL-related Humor : OFM Humor : Politically Incorrect Humor : IDS Humor : "Linux Sucks" Humor : Russian Musical Humor : Best Russian Programmer Humor : Microsoft plans to buy Catholic Church : Richard Stallman Related Humor : Admin Humor : Perl-related Humor : Linus Torvalds Related humor : PseudoScience Related Humor : Networking Humor : Shell Humor : Financial Humor Bulletin, 2011 : Financial Humor Bulletin, 2012 : Financial Humor Bulletin, 2013 : Java Humor : Software Engineering Humor : Sun Solaris Related Humor : Education Humor : IBM Humor : Assembler-related Humor : VIM Humor : Computer Viruses Humor : Bright tomorrow is rescheduled to a day after tomorrow : Classic Computer Humor

The Last but not Least Technology is dominated by two types of people: those who understand what they do not manage and those who manage what they do not understand ~Archibald Putt. Ph.D

The statements, views and opinions presented on this web page are those of the author (or referenced source) and are not endorsed by, nor do they necessarily reflect, the opinions of the Softpanorama society. We do not warrant the correctness of the information provided or its fitness for any purpose. The site uses AdSense so you need to be aware of Google privacy policy. You you do not want to be tracked by Google please disable Javascript for this site. This site is perfectly usable without Javascript.

Last modified: December 05, 2011