I realize that both Keyword scanning and File attachment scanning are content related, I even realize in spamfilter program same sting compare thread/function can be used, but i don't get why logically both grouped together in spamfilter. I mean, "Attachments are not keywords!" Franklyshould not be treated the same.

1) When test is positive, sender receives same obscure NDR. Could a new feature be added so that NDR can be separated for each type? If possible items such as %Attachment% and %Keyword% variables become available so admins can write NDR which reflects what file is rejected or a what keyword is rejected. Even for debug reasons, it is good practice.

2) When keyword scanning is skipped because MaxMsgSizeForKeywordScan is exceeded, does an attachment-scanning stop as well??? I stop ALL ZIP files, and i find in some cases that are not stopped (very alarmed). Only reference in log for that interaction says:

Warning - Message exceeds MaxMsgSizeForKeywordScan, skipping statistical scan 

Alex