To enable a filter you need to use a rexx script in the filter directory, 4 filters exists 3 for SMTP and 1 for POP3 external mailbox fetch, here are the names of the file (script) that ZxMail looks for, when starting if the file exists it is loaded and ready to be used:

1. Smtp.flt - this filter is runned just after the data command is sent, no file exists, but the from and recipient are known.
2. Smtpdata.flt - this filter is runned at the end of the data command before the server responds if it accepts or not the email(a sample file named smtpdata.sam is found in the filter directory, with a bit more explanation).
3. smtpinit.flt - this filter is run at the start of an smtp session, the from and recipient are not known no file has been received, only the ip address of the client is known.
4. pop3.flt - this filter is run when ZxMail fetches mail from an external POP3 server

This is a sample i use to check incoming ip address with ORDB, Mail-abuse.og and SPAMCOP, ORDB reports open relays only, and SPAMCOP reports spam incidents, be warned some email you want to go through may be blocked by SPAMCOP or ORDB so use carefully, that is why i allways keep a copy of the email in a spam directory i created in the ZxMail install directory, so here it is:

ORDB

/**/

/* we check for spam now */
/* comment out the spam db you do not want to use */
/* ORDB go to http://www.ordb.org for more info */
/* this list only reports open relays */
rc = ZxSpamCheck(smtpdata.!peername,"ORDB")
if rc <> 0 then
do

rc = ZxLineout(spamfile,"[smtpdata.flt]["|| Date() Time() ||"]ORDB flagged this email as spam, ip of host was "||smtpdata.!peername)
rc = ZxSetAltResp(sessionid,"Enter the response you want to send")
/* we keep a copy to double check legitimate mail is not getting
blocked */
"copy "smtpdata.!file spamdir
/* returning 1 tells the server to abort transaction and delete pending email */
return 1
end /* end of ORDB check*/

SPAMCOP

/* SPAMCOP go to http://www.spamcop.net for more info */
/* this db reports spam turned in by users, it is quite agressive so be carefull if you use it */
rc = ZxSpamCheck(smtpdata.!peername,"SPAMCOP")
if rc <> 0 then
do
rc = ZxLineout(spamfile,"[smtpdata.flt]["|| Date() Time() ||"]SPAMCOP flagged this email as spam, ip of host was "||smtpdata.!peername)
rc = ZxSetAltResp(sessionid,"You have been marked as an open relay, please correct the situation, you can find more info about this on this site: http://spamcop.net/")
/* we keep a copy to double check legitimate mail is not getting
blocked */
"copy "smtpdata.!file spamdir
return 1
end

MAIL-ABUSE

/* MAIL-ABUSE go to http://mail-abuse.org for more info */
/* this db reports spam turned in by users */
rc = ZxSpamCheck(smtpdata.!peername,"OTHER","blackholes.mail-abuse.org")
if rc <> 0 then
do
rc = ZxLineout(spamfile,"[smtpdata.flt]["|| Date() Time() ||"]SPAMCOP flagged this email as spam, ip of host was "||smtpdata.!peername)
rc = ZxSetAltResp(sessionid,"You have been marked as an open relay, please correct the situation, you can find more info about this on this site: http://mail-abuse.org/referred.html")
/* we keep a copy to double check legitimate mail is not getting
blocked */
"copy "smtpdata.!file spamdir
return 1
end

/* this was not a spam email we return 0 to keep processing */
return 0

This filter i created to scan with Norton Anti-Virus, and also Norman Anti-Virus (doing tests for both AV for an email server) Norman has a major flaw when it comes to email viruses, it cannot (as of version 5.0) scan embedded emails (namely emails with an email attached which contains a virus attached, Klezt is such a virus) considering this fact i strongly do not recommend it, Norton scans better but still lets some virus run through, so you will still need a desktop AV for your workstation.

Now for the filter itself here is the code i use:

/**/

file = "log\virus.log"
spamdir = ".\spam\"
virusdir = ".\virus\"

/* this function is the thread safe equivalent of lineout no need to close the file/
you must use this to write to files to unless the file is not the same use by all scripts/
i.e different name generated for output file, if you try to access a file concurrently in/
a multi thread program it will lock the program, this is because
it is under the same process (design limit of threading)
we use a mutex semaphore to serialize access
to use it first param is the file name, the second is the text you want to output
the function allways returns 0 i may change that to return bytes written will see */

/*
we scan for a virus we will log the info in a virus
log and see what comes up
*/
/* we check if it is a message thta is internal to the network

no need to scan twice that is assuming all workstation have AV
activated and rotecting them*/

parse value smtpdata.!peername with ip1'.'ip2'.'ip3'.'ip4

/*if local no scan keep going*/
if ip1 == 10 && ip2 == 1 && ip3 == 1 then
do
nrc = ZxLineout(file,"[smtpdata.flt]["|| Date() Time() ||"]Internal net will not scan ip="smtpdata.!peername)
return 0
end

/*Virus var to flag when virus found*/

virus = 0

/*This block is used when using Norman AV*/
/*'nvcc /CP /C /N /U /Q /O /CL 'smtpdata.!file
if rc==1 then
do
nrc = ZxLineout(file,"[smtpdata.flt]["|| Date() Time() ||"]Norman found a virus in the email")
"copy "smtpdata.!file virusdir
nrc = ZxSetAltResp(sessionid,"The email contained a Virus transaction refused");
return 1
end*/

/*ok here is the call to the norton command line scanner

if a virus is found a line is writen to a virus.log and also we set a return message explaining why we are rejecting this message, in this case we warn that a virus has been found, and we refuse to relay this message, by returning 1 it tells ZxMail that the message is to be refused and deleted, i keep a copy so the copy command
is up to you it copies into a virus dir i created in zxmail, it is defined at the start of this code

*/

'd:\programs\symantec\navdxos2 'smtpdata.!file' /B- /S- /CFG:\programs\symantec /DOALLFILES /ZIPS /NOBEEP /NOPROMPT'
select
when rc == 0 then
noop
when rc == 5 then
nrc = ZxLineout(file,"[smtpdata.flt]["|| Date() Time() ||"]NAV Memory error from the scanner ran out of memory")
when rc ==6 then
nrc = ZxLineout(file,"[smtpdata.flt]["|| Date() Time() ||"]NAV Invalid parameters given to NAV")
when rc == 11 then
nrc = ZxLineout(file,"[smtpdata.flt]["|| Date() Time() ||"]NAV internal error")
when rc == 102 then
nrc = ZxLineout(file,"[smtpdata.flt]["|| Date() Time() ||"]NAV CTRL-Break sent")

when rc == 13 then do
nrc = ZxLineout(file,"[smtpdata.flt]["|| Date() Time() ||"]NAV found a virus in the email")
"copy "smtpdata.!file virusdir
virus = 1
end
when rc == 20 then do
nrc = ZxLineout(file,"[smtpdata.flt]["|| Date() Time() ||"]NAV found a virus in the email")
"copy "smtpdata.!file virusdir
virus = 1
end
when rc == 21 then do
nrc = ZxLineout(file,"[smtpdata.flt]["|| Date() Time() ||"]NAV found boot virus?")
"copy "smtpdata.!file virusdir
virus = 1
end
when rc == 22 then do
nrc = ZxLineout(file,"[smtpdata.flt]["|| Date() Time() ||"]NAV found a macro virus")
"copy "smtpdata.!file virusdir
virus = 1
end
otherwise
nrc = ZxLineout(file,"[smtpdata.flt]["|| Date() Time() ||"]NAV Unknown return code "rc)
end

if virus==1 then
do
nrc = ZxSetAltResp(sessionid,"The email contained a Virus transaction refused");
return 1
end

return 0