How emails are processed#

Every Sync Frequency minutes (5 by default), SynergyCP logs in to the configured mailbox, reads every message in the inbox, and processes each one as described below. Messages are handled one at a time; a message that fails is logged and left in the inbox, and the sync continues with the next one.

Skipped messages#

A message is skipped (archived without creating a report) when it was sent from the IMAP User address itself. This stops replies you send from the abuse mailbox from being imported as new reports.

Finding the reported IP address#

SynergyCP looks for IP addresses in this order and stops at the first source that yields one:

1. XARF JSON attachments. Any attachment with a .json extension is parsed as an XARF report, and the Source-IP field (top level or under Report) is used. Many automated abuse senders, including large blocklist operators, attach XARF data.
2. XML attachments. Any .xml attachment is searched for a source IP tag (<Source-IP>, <SourceIP>, <source_ip>, <Source>, <ip>).
3. Subject and body. Every IPv4 and IPv6 address found in the subject line or the message body is collected. The plain-text part of the message is used; HTML-only messages have their tags stripped first. Ranges (CIDR notation) are reduced to their first address, and duplicates are removed.
4. Domain resolution (optional, off by default) — only if none of the above found an address. See below.

An attachment that cannot be read or parsed is logged and ignored; processing continues with the next source.

Matching addresses to servers#

Each address found is looked up against the IP entities in SynergyCP:

• If at least one of the addresses in the email belongs to an IP entity in your deployment, only those matching addresses become reports. Addresses in the same email that are not yours — for example the complainant’s own address quoted in a log excerpt — are ignored.
• If none of the addresses belong to you, a report is still created for every address found, so that nothing is silently dropped. These reports have no server or client and land in the Unknown tab for an admin to review.
• Loopback addresses (127.0.0.x) are never reported.

A matched address is linked to its IP entity, to the server that entity is assigned to, and to the client who holds that server. When the server has a client, the report’s status is set to Waiting on CLIENT; otherwise it is Waiting on ADMIN (shown in the Unknown tab when there is no client at all).

One report is created per address per email. Reports are unique per message and address, so the same message being seen again (for example after an interrupted sync) never produces duplicate reports. A forwarded copy of a report is a new message and does create a new report.

Report contents#

Each report stores the sender address (shown as Abuse Authority in the list), the subject, the date the email was sent, and the full plain-text body. The body is shown verbatim on the report page under Report Body; attachments themselves are not stored, so keep the archived email if you need the original.

Domain resolution#

Some abuse reports, particularly phishing and copyright complaints, name a hostname (shop.example.com) rather than an IP address. By default such emails produce no report and are logged as “no IPs found in email”.

Ticking Resolve domain names to IP addresses in System > Settings > Abuse Reports enables a fallback that only runs when an email contains no IP address anywhere (attachments, subject, or body):

1. Hostnames are collected from the subject and body — lower-cased, de-duplicated, in order of appearance, and capped at 25 per email to avoid a flood of DNS queries. Bare IP addresses, the domain part of email addresses, filenames (report.json, index.php, etc.), and reserved names (.local, .arpa, .invalid, .onion, …) are not treated as hostnames.
2. Each hostname is resolved via DNS — A records first, then AAAA.
3. The first resolved address that belongs to a server in your deployment is used for the report, and that domain is logged as “resolved domain to server IP”. A hostname behind a CDN or round-robin DNS may resolve to several addresses; only the first one that is yours is used.
4. If no hostname resolves to an address in your deployment, no report is created and the email is logged as “domain resolved to no IP address in SynergyCP” with every hostname and address that was tried.

Emails that do contain an IP address are processed exactly as before, whether or not this option is on.

After processing#

• The message is moved from the inbox to the Archive Folder. If that folder does not exist on the mail server, the move fails: the report is still created, but the message stays in the inbox and every following sync logs an “Abuse error while saving report” entry for it until the folder is created.
• A “report created” log entry is written for each report, and a “ReportCreated” event fires: if the report has a client and Send abuse emails is on, the “Abuse Report Received” email goes out.

When servers, clients, or IPs change#

Reports follow the lifecycle of the things they are linked to: