Eric, You convinced me on the 2nd but not on the 1st. Being a postmaster of this very LISTSERV node implies that (a) I can probably access the LISTSERV disks directly, and (b) I can TELL LISTSERV CMS SENDFILE and bypass all your checks. Why then deny GET? There's no real point, I think. Doron