F-SECURE INTERNET GATEKEEPER FOR LINUX 4.01 Administrator's Manual page 153

DATA command
1 The following is sent to the client: 354 Enter mail ([Product name])
2 Mail data is received.
3 Mail data is scanned for viruses or spam.
4 If a virus or spam is detected:
① Virus logs are recorded.
② A notification is sent to the administrator (if notification sending is enabled).
5 If the e-mail size is greater than the maximum message size:
① The following is sent to the client: 554 Too long message ([Product name])
6 If a virus or spam is detected and action on detection is set to "Clean", "Do nothing" or "Change
subject":
① If "Deny" is set as the action:
1) The following is sent to the server: RSET
2) Receives a response from the server.
3) If the response code is other than 250, the session ends.
4) The following is sent to the client: 554 Infected by [Detection name] ([Product name])
② If "Notify the sender" is set as the action
1) The following is sent to the server: RSET
2) If the response code is other than 250:
a) The following is sent to the client: 554 :SENDBACK:smtp error[RSET]: (Server Reply:
[Server response information]) ([Product name])
3) The following is sent to the server: MAIL FROM: [Template sender or administrator address]
4) If the response code is other than 250:
a) The following is sent to the client: 554 SENDBACK:smtp error[MAIL FROM] (Server Reply:
[Server response information]) ([Product name])
5) The following is sent to the server: RCPT TO: <Sender address>
6) If the response code other than 250:
a) The following is sent to the client: 554 SENDBACK:smtp error[RCPT TO] (Server Reply:
[Server response information]) ([Product name])
③ If the action on detection is set to "Notify the sender" or "Notify the recipient":
1) The following is sent to the server: DATA
2) If the response code other than 354:
a) The command terminates.
3) The following is sent to the server:
Received: from [Client host name] ([Client IP address])
by [Host name] (Product name])；
[Current time (RFC822 format)]
4) If spam is detected:
a) The following is sent to the server: X-Spam-Status: Yes(Product name) with [Detection name]
5) If a virus is detected:
a) The following is sent to the server: X-Virus-Status: infected(Product name) with [Detection
name]
6) The following is sent to the server: Data: [Date field information of the e-mail received]
7) If "Notify the sender" is set as the action:
a) The following is sent to the server: To: [Sender address of the e-mail received]
8) If "Notify the recipients" is set as the action:
F-Secure Internet Gatekeeper for Linux/Administrator's Guide
153