?
Solved

Read Receipt Alternatives

Posted on 2006-04-17
14
Medium Priority
?
1,165 Views
Last Modified: 2011-09-20
The problem with read receipts is that people have the option to not have one sent. I have domain admin privelages and I could force the option, but I don't want it to be forced. Instead, I am looking for an alternative way of verifying an email has been read (or at least opened).

One possible solution I thought of is a spammer's technique of embedding an image in an email. When the image is loaded they know your email address is legit. Is there something out there that would let me do something similar on a much smaller scale? (about 50 employees). Any ideas?
0
Comment
Question by:DVation191
  • 7
  • 7
14 Comments
 
LVL 76

Expert Comment

by:David Lee
ID: 16471553
Hi DVation191,

is there any reason you want to devise a way of doing this rather than just force the issue?  

Cheers!
0
 
LVL 20

Author Comment

by:DVation191
ID: 16471635
Because I don't know of any way to distinguish forcing the return of a read receipt internally. I don't want them to have to respond with a read receipt that were requested externally unless they want to.
0
 
LVL 76

Expert Comment

by:David Lee
ID: 16472141
This is in an Exchange environment?
0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 20

Author Comment

by:DVation191
ID: 16472191
Yes, exchange 2000
0
 
LVL 76

Expert Comment

by:David Lee
ID: 16473437
DVation191,

I'm not near an Exchange server at the moment, so I can't verify what I'm about to say.  With that in mind, I believe there's a setting in Exchange that can control whether receipts go to the internet or not.  If I'm right about that, then you could use a policy to enforce receipts and use the Exchange setting to prevent them from going to the internet.  If that doesn't sound like a good solution, or if I'm wrong and there is no setting in Exchange for controlling this, then you could use the graphic solution you mentioned.  Although with that I'm not sure how you're going to distinguish one message from another.  Yet another alternative is to write an Outlook addin that handles this.  You'd have to install it on each user's computer and then lock their environment down so they couldn't change it or turn it off.  
0
 
LVL 20

Author Comment

by:DVation191
ID: 16477839
BlueDevilFan,
That is true...and I am aware of the ability to block read receipts externally. The problem is, I *want* them to be able to go to the outside (with the employees permission, of course). That is why I need an alternative to Outlooks "read receipt" system. I'm surprised I haven't had any suggestions so far.
0
 
LVL 76

Expert Comment

by:David Lee
ID: 16479579
DVation191,

I understand.  I don't see any options beyone what I've already mentioned.  For this to work properly there has to be some intelligence at the user's end.  The graphic thing won't work like a receipt because it will fire every time the user opened the message and unless you had a separate graphic for each message you wouldn't know which message they opened.  Outlook won't allow any kind of script in a message, so you can't place code in the body of the message that would fire when the message opened.  Even if you could you'd suffer from the same problem as the graphic in that it'd fire every time the person opened the message.  A macro would work, but the user could disable it easy enough.  Unless there's a policy I'm forgetting about that would lock down their ability to get to macros.  If you have administrative rights and some programming skill, then you could write a service that'd do this and install it on their computers quietly.  If they don't have admin rights on their computers then I don't think they'd be able to stop the service.  This approach would require a third-party utility though to get around Outlook's built-in security.  Even then a clever user could circumvent this by telling Outlook to work off-line, capturing the receipts in the Outbox and deleting them.  
0
 
LVL 20

Author Comment

by:DVation191
ID: 16480426
"The graphic thing won't work like a receipt because it will fire every time the user opened the message and unless you had a separate graphic for each message you wouldn't know which message they opened."
Web Bugs do this by using a script with the users email address in it to download an image in the mail (or web page) they are viewing. That's how I'd know it was opened.

"Outlook won't allow any kind of script in a message, so you can't place code in the body of the message that would fire when the message opened."
It's simple HTML that allows this, and Outlook is capable of reading HTML email.

" Even if you could you'd suffer from the same problem as the graphic in that it'd fire every time the person opened the message."
I'm okay with that. Since I'm sure anyone that implemented something like this already thought of that, I'm sure subsequent mail openings would be ignored. Even if they weren't, I'd be okay with that.

"If you have administrative rights and some programming skill, then you could write a service that'd do this and install it on their computers quietly."
I have the rights, not the programming ability. Hence, my EE question :)

"Even then a clever user could circumvent this by telling Outlook to work off-line, capturing the receipts in the Outbox and deleting them.  "
That's a risk I'd be willing to take. I don't know any users here that would know or even care to figure out how to do that anyway.
0
 
LVL 20

Author Comment

by:DVation191
ID: 16480589
Here is a good example of what I want to do:
http://www.nthelp.com/OEtest/oe.htm

While it works great, they don't tell you how to implement it yourself.
0
 
LVL 76

Accepted Solution

by:
David Lee earned 2000 total points
ID: 16483234
I already knew how this done when I wrote my earlier comments.  First, here's how it's done.  The key is this little bit of HTML

    <img src="http://216.144.1.23/oe.gif?Someone@somewhere.com" alt="oe.gif (1024 bytes)">

which triggers an HTTP connection to the computer hosting the image to download that image.  Any connection to a web server is noted in the server's web log.  It's then a simple matter to read the log file and look for those connection entries.  While this works well for verifying an email address it's not a convenient way to record that your message was received.  Consider the issues.  First, every message you send is going to have to be in HTML format.  Second, how are you going to insert the image tag?  Third, you're going to have to add parameters to the image tag uniquely identifying the message and the recipient.  Fourth, forget about using distribution lists.  If you did use one you'd have no means of determining which recipients read the message.  All you'd know was that x recipients had read it.  You wouldn't know which ones, or when a given recipient read it.  Fifth, don't forget to insert the image tag in every message you want a receipt for.  Sixth, to see the results you'd have to read through the server's web log.  You might have to parse through several days' worth to find all the read receipts.  Seventh, this approach is easily defeated.  Microsoft recognizes the potential threat and had added a configuration option to control the downloading of images.  If Outlook is set to not download images, then this immediately falls apart.  Another way to defeat it is to set Outlook to read all message in plain text format.  Plain text doesn't ignores HTML tags.  Can this work?  To some degree, yes.  Is it practical?  Not really.  It requires far too much effort, is easily avoided, and it'll be cumbersome to collect the results.

> I have the rights, not the programming ability.
I have the programming skill, but this isn't a simple undertaking.  The code would have to detect when a user is logged in, connect to Outlook when they are, trap message opening events, test to see if the item is requesting a receipt, determine whether the sender is internal, and send a receipt as needed.  To avoid Outlook's built-in security we'd have to use Outlook Redemption.  It's not as simple as a quick script.  It'd also not work for messages read via OWA.  

0
 
LVL 20

Author Comment

by:DVation191
ID: 16487503
" First, every message you send is going to have to be in HTML format. "
Not true, only the emails that I want to verify are being opened will need to be in HTML

"Second, how are you going to insert the image tag? "
There are plenty of ways ... http://www.slipstick.com/mail1/html.htm

"Third, you're going to have to add parameters to the image tag uniquely identifying the message and the recipient. "
I don't really see that as a problem considering the frequency I actually plan on doing this...1 or 2 emails a week at the most.

"Fourth, forget about using distribution lists."
True. Except that in the web logs I can at least verify by IP...more tedious, sure, but doable.

" Fifth, don't forget to insert the image tag in every message you want a receipt for. "
I think that goes without saying :)

"Sixth, to see the results you'd have to read through the server's web log. "
Also, not a problem.
http://www.microsoft.com/technet/scriptcenter/tools/logparser/default.mspx

"Seventh, this approach is easily defeated.  Microsoft recognizes the potential threat and had added a configuration option to control the downloading of images."
True, but I can use Group Policy to add my domain to the "safe senders" list and Outlook will not block the image. The policy is in the Office 2003 ADM template.

"Another way to defeat it is to set Outlook to read all message in plain text format."
Nobody has Outlook set up that way in my organization...so this is also not an issue.

"The code would have to detect when a user is logged in, connect to Outlook when they are, trap message opening events, test to see if the item is requesting a receipt, determine whether the sender is internal, and send a receipt as needed."
Really, the only thing I can think of that would make this easier would be to configure the web log parser to somehow be able to only parse the outlook requests. Otherwise, seems rather simple to me.


0
 
LVL 76

Expert Comment

by:David Lee
ID: 16489391
>" First, every message you send is going to have to be in HTML format. "
> Not true, only the emails that I want to verify are being opened will need to be in HTML
Which is what I meant.  Every message that you want a receipt for.

> "Second, how are you going to insert the image tag? "
> There are plenty of ways ... http://www.slipstick.com/mail1/html.htm
I know it's possible to insert an image tag, my point was that it's not as straightforward as checking a box to indicate you want a receipt.  It's extra steps, easily forgotten, and any mistake in the image tag will result in no receipt.

> "Fourth, forget about using distribution lists."
> True. Except that in the web logs I can at least verify by IP...more tedious, sure, but doable.
Definitely doable as long as you're willing to take the time to go through the logs.

> "Another way to defeat it is to set Outlook to read all message in plain text format."
> Nobody has Outlook set up that way in my organization...so this is also not an issue.
But they could switch to that any time they wanted to avoid generating a receipt.

> "The code would have to detect when a user is logged in, connect to Outlook when they are, trap message opening events, test to see > if the item is requesting a receipt, determine whether the sender is internal, and send a receipt as needed."
> Really, the only thing I can think of that would make this easier would be to configure the web log parser to somehow be able to only  > parse the outlook requests. Otherwise, seems rather simple to me.
I was talking about the service approach I'd mentioned, not this solution.

I'm not trying to disuade you from using this, I just wanted to point out what I see as flaws so you can make an informed decision.  If this approach works for you, then my advice is to run with it.  You can make the log parsing a bit easier by looking for a web log parsing tool.  There should be some on any number of shareware web sites.
0
 
LVL 20

Author Comment

by:DVation191
ID: 16497759
Ok great. Well I think I should be able to make this work thanks to your help.
0
 
LVL 76

Expert Comment

by:David Lee
ID: 16502900
Cool.  Good luck.
0

Featured Post

Veeam and MySQL: How to Perform Backup & Recovery

MySQL and the MariaDB variant are among the most used databases in Linux environments, and many critical applications support their data on them. Watch this recorded webinar to find out how Veeam Backup & Replication allows you to get consistent backups of MySQL databases.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article I discuss my selections of the Top Four free Outlook OST File Viewers available. Open, view and read even damaged OST files by using these tools. They all provide a clear preview of all data such as emails, notes, tasks, calendars, e…
There can be many situations demanding the conversion of Outlook OST files to PST format and as such, there is no shortage of automated tools to perform this conversion. However, what makes Stellar OST to PST converter stand above the rest? Let us e…
Get people started with the process of using Access VBA to control Outlook using automation, Microsoft Access can control other applications. An example is the ability to programmatically talk to Microsoft Outlook. Using automation, an Access applic…
A short tutorial showing how to set up an email signature in Outlook on the Web (previously known as OWA). For free email signatures designs, visit https://www.mail-signatures.com/articles/signature-templates/?sts=6651 If you want to manage em…
Suggested Courses

850 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question