Attachments not blacklisted |
Post Reply 
|
| Author | |
Tomm 
Newbie 
Joined: 25 March 2015 Location: Australia Status: Offline Points: 2 |
 Post Options
 Thanks(0)
 Quote Reply
 Topic: Attachments not blacklistedPosted: 26 March 2015 at 12:00am |
|
Hi All, We've recently started blacklisting by attachment matching "*.zip" due to a spate of new spam with viruses in zip files. However, emails with zip attachments are still getting through, the log entry is "Whitelisted - Email size exceeded MaxMsgSizeForSpamFiltering" That test email was only 3MB altogether. The size listed on the Configuration Tab for "Max email size in KB" is 30480. Please help me understand this. Version is 4.7.0.126
|
|
 |
|
|
LogSat
Admin Group 
Joined: 25 January 2005 Location: United States Status: Offline Points: 4104 |
Post Options
Thanks(0)
Quote Reply
Posted: 26 March 2015 at 12:31am |
|
Tomm,
We're not able to replicate the issue - sending a test email with a .zip attachment that is 4MB in size, with the SpamFilter.ini containing this value: MaxMsgSizeForSpamFiltering=30480 does result in the email being quarantined: 03/26/15 00:22:59:187 -- (18662720) Connection from: 10.211.55.7 - Originating country : N/A 03/26/15 00:22:59:328 -- (18662720) Received MAIL FROM: roberto4@test.logsat.com 03/26/15 00:22:59:328 -- (18662720) Received RCPT TO: roberto5@netwide.net 03/26/15 00:23:02:343 -- (18662720) Found Keywords: [Found prohibited attachment: complete network spam 2-16-15.zip] 03/26/15 00:23:02:343 -- (18662720) EMail from roberto4@test.logsat.com to roberto5@netwide.net matches content filter rules - rejected. 03/26/15 00:23:03:218 -- (18662720) Starting quarantine procedures 03/26/15 00:23:03:234 -- (18662720) Created thread (18558800) to add email to quarantine 03/26/15 00:23:03:234 -- (18558800) Adding to Quarantine file:QrtnBEAD2701-839F-40DA-9F95-11DEEA02E79C.tmp 03/26/15 00:23:03:250 -- (18662720) Disconnect 03/26/15 00:23:03:484 -- (18558800) EMail from roberto4@test.logsat.com to roberto5@netwide.net was received and quarantined. Size: 3980 KB, 4075520 bytes Can you please zip us the following so we can take a better look:
• SpamFilter's activity logfile for today (or a day this happened) • The email that was delivered - please include the email as an attachment, not forwarding it to us "inline" via email so as to retain the original message format • Your SpamFilter.ini file • The \SpamFilter\Domains directory structure (if the files containing any of your blacklists/whitelists are outside that directory tree, please include those as well. If the zipped file is over 8MB in size, please try to upload the file to our repository - I'll send you the URL/password in a separate PM.
Thanks, Roberto Franceschetti LogSat Software |
|
|
|
|
yapadu
Senior Member 
Joined: 12 May 2005 Status: Offline Points: 297 |
Post Options
Thanks(0)
Quote Reply
Posted: 05 April 2015 at 9:06am |
|
Tomm,
I don't know how you are calculating the size of the message, but if you are sending a 3 meg attachment it will actually be larger than that. The email client will convert it into a MIME encoded string and the size will increase by 30% or more, which would take it over your 30480 for sure. |
|
|
--------------------------------------------------------------
I am a user of SF, not an employee. Use any advice offered at your own risk. |
|
|
|
Topic Options|
Post Reply
|
|
Tweet
|
| Forum Jump | Forum Permissions You cannot post new topics in this forum You cannot reply to topics in this forum You cannot delete your posts in this forum You cannot edit your posts in this forum You cannot create polls in this forum You cannot vote in polls in this forum |
This page was generated in 0.145 seconds.