Unknown email

The latest version of NAV for Exchange uses VAPI, Microsoft's antivirus API. It's better in a lot of ways than MAPI, which was how older versions scanned mail. VAPI scanns faster, is more reliable and won't let known virsues slip through like MAPI. The downside to VAPI is that it doesn't have much at all in the way of reporting.

The reports of "unknown" aren't because there was nothing in the mail header and the mail was literally to "unknown", it's just that VAPI is too primitive to read the header. MAPI would give you better reports and alerts, but doesn't work as well in it's primary job -- stopping viruses. I'd stick with VAPI or the combiniation mode. You can run NAVMSE in VAPI/MAPI mode, which means you'll get more information inyour reports and alerts. You may already be doing this, though, you'll still get some alerts with "unknown". Hopefully they'll improve this someday to increase the information reported but until then, NAVMSE users are stuck with this.

What I'm trying to say is that you're not receiving mail addressed to "unknown". That's not possible. If mail was address to no domain or user, it wouldn't hit your server at all. The reason you're seeing Norton messages saying mail is to unknown and from unknown is because reporting stinks in VAPI.

You can block incoming mail based on domains. Open the properties of the Intenet Mail Service in Exchange Admin and click on the Connections tab. There is a butting with the label Message Filtering... In that box, you can block incoming mail. If you wanted to block an entire domain, add the entry @domainname.com. I block a number of domains that are spam-only and have no business use.