MAILsweeper Services Data Flow and Data File Management Processes
All messages parts and associated files for any message are always identified
with the unique message number with extension.

1. SMTPRS (receiver service) accepts inbound transmission. ... it creates the
data files in ..\spool\unchecked\.. .RCO (temporary RFC 2821 routing info
from and SMTP transmission dialogue) .MSG (messages mime data) when
inbound transmission complete the .RCO is renamed to .RCP (messages RFC
2821 routing info from and SMTP transmission) The .RCO are created and
renamed very quickly .. one would not normally expect to see this data type
in unchecked. Their presence could indicate a data locking problem.
2. SMTPSS (security service) monitors the ..\spool\unchecked\.. .. when new
pairs(.rcp/.msg) are available the security engine will attempt to process up
to 5 of these pairs Emails pairs in engine processing are indicated with a .lck
marker file. .lck (messages processing marker file) when the processing is
complete the pair is moved to its destination..
2.a. For clean pass these are moved to the ...\spool\checked\.. folder.
the .lck file for this completed pair is deleted and a new pair begins
processing with a new.lck file created.
2.b for email being Qtined the data is deconstructed for inclusion in message
area database files (.a .b files) in the ..\message area\qtine\ the .lck file
for this Qtined is deleted and a new pair begins processing with a new.lck file
created. When Emails are released from Qtine messages area the .rcp
and .msg data files are reconstructed from the database files in
the ..\spool\checked\.. folder.
2.c For email where the message email MIME is uninterpretable or the CPU
processing thread fails. the .lck file is renamed .stk .. the security service will
ignore email pairs marked with a .stk file. .stk (messages processing failed
marker) When the .stk is created and a new pair begins processing with a
new.lck created. The Security service will mark any .RCP file it received without
an accompanying .MSG pair with a .stk marker. This commonly happens
when .MSG .RCP pairs are manually copied/moved in the unchecked folder
when you have no control over the order that the data is written. The stuck
pairs will be moved into the recovery folder. Pairs will also be marked with
a .stk marker if it already exists in the destination folder. (for example; if
you copy a pair from recovery into unchecked it will be marked as .stk and
remain there until manually deleted because it already exists in it's
destination folder ..\spool\recovery\..) When the data has been moved
successfully the .stk file for this pair is deleted.
2.d. For an email where the classification found has no delivery oriented
actions the message data pair will be deleted.
3. SMTPDS (delivery service) monitors the ..\spool\checked\.. folder for .rcp
and .msg pairs. When they are present from each pair is the .msg is moved
to ..\spool\holding\ and a new .lck is created in the holding directory.
The .msg will remain in the holding until delivered to all destinations. .lck
(delivery service marker for destination count factor) The .rcp is read by the
SMTPDS while calls for DNS or Delivery routing and alias tables checked.
Temporary .rco files are created in ..\spool\domains\.. sub-Folder of the
name of the destination domain. Results of DNS or routing table lookup and
Alias list check information is written to the temporary file .rco (temporary RFC
2821 routing info) When complete the .rco is renamed .rcp (this normally only
talks milliseconds, so seeing .rco's may indicate an Data locking problem)
The delivery service monitors Domains sub-folder structures for .rcp files the
delivery service will call(SMTP transmission dialogue)to the next host
described in the oldest .rcp in a domains subfolder.
3.a. when the SMTP dialogue is complete the .lck is updated to one less
destination count and .rcp is deleted from the domains subfolder if the
the .lck has a destinations count of 0(zero) the .msg and .lck will be deleted
from holding. This is achieved with a Background "housekeeping" thread-job
that runs periodically. So, it is possible you may see .msg and .lck remaining
a short while after the messages delivered and domain folder and .rcp has
been deleted.
3.b If an transient error occurs in dialogue with the nest host then a
domain.mri destination host error file is written in the domains subfolder and
will be re-called at the next retry interval.
3.c If a Permanent error occurs in the dialogue with the next host then the
SMTPDS will create a NDR (non delivery report) attaching the original,
returning to the appropriate sender address. The .rcp deleted and .msg
and .lck will be updated or deleted accordingly
3.d. If a Permanent error occurs and the NDR cannot be delivered then a copy
of the .msg is made in Dead with extension .txt. The .rcp deleted and .msg
and .lck will be updated or deleted accordingly A domains sub folder currently
engaged in a SMTP dialogue with a remote host is marked with a .dlk
(domain lock) marker. .dlk (domain dialogue thread marker)