Spam Filter ISP Support Forum

  New Posts New Posts RSS Feed - Attachments not blacklisted
  FAQ FAQ  Forum Search   Register Register  Login Login

Attachments not blacklisted

 Post Reply Post Reply
Author
Tomm View Drop Down
Newbie
Newbie
Avatar

Joined: 25 March 2015
Location: Australia
Status: Offline
Points: 2
Post Options Post Options   Thanks (0) Thanks(0)   Quote Tomm Quote  Post ReplyReply Direct Link To This Post Topic: Attachments not blacklisted
    Posted: 26 March 2015 at 12:00am
Hi All,

We've recently started blacklisting by attachment matching "*.zip" due to a spate of new spam with viruses in zip files.

However, emails with zip attachments are still getting through, the log entry is "Whitelisted - Email size exceeded MaxMsgSizeForSpamFiltering"

That test email was only 3MB altogether. The size listed on the Configuration Tab for "Max email size in KB" is 30480.

Please help me understand this.

Version is 4.7.0.126
Back to Top
LogSat View Drop Down
Admin Group
Admin Group
Avatar

Joined: 25 January 2005
Location: United States
Status: Offline
Points: 4068
Post Options Post Options   Thanks (0) Thanks(0)   Quote LogSat Quote  Post ReplyReply Direct Link To This Post Posted: 26 March 2015 at 12:31am
Tomm,

We're not able to replicate the issue - sending a test email with a .zip attachment that is 4MB in size, with the SpamFilter.ini containing this value:

MaxMsgSizeForSpamFiltering=30480

does result in the email being quarantined:

03/26/15 00:22:59:187 -- (18662720) Connection from: 10.211.55.7  -  Originating country : N/A
03/26/15 00:22:59:328 -- (18662720) Received MAIL FROM: roberto4@test.logsat.com
03/26/15 00:22:59:328 -- (18662720) Received RCPT TO: roberto5@netwide.net
03/26/15 00:23:02:343 -- (18662720) Found Keywords: [Found prohibited attachment: complete network spam 2-16-15.zip]
03/26/15 00:23:02:343 -- (18662720) EMail from roberto4@test.logsat.com to roberto5@netwide.net matches content filter rules - rejected.
03/26/15 00:23:03:218 -- (18662720) Starting quarantine procedures
03/26/15 00:23:03:234 -- (18662720) Created thread (18558800) to add email to quarantine
03/26/15 00:23:03:234 -- (18558800) Adding to Quarantine file:QrtnBEAD2701-839F-40DA-9F95-11DEEA02E79C.tmp
03/26/15 00:23:03:250 -- (18662720) Disconnect
03/26/15 00:23:03:484 -- (18558800) EMail from roberto4@test.logsat.com to roberto5@netwide.net was received and quarantined. Size: 3980 KB, 4075520 bytes

Can you please zip us the following so we can take a better look:

• SpamFilter's activity logfile for today (or a day this happened)

• The email that was delivered - please include the email as an attachment, not forwarding it to us "inline" via email so as to retain the original message format

• Your SpamFilter.ini file

• The \SpamFilter\Domains directory structure (if the files containing any of your blacklists/whitelists are outside that directory tree, please include those as well.


If the zipped file is over 8MB in size, please try to upload the file to our repository - I'll send you the URL/password in a separate PM.

 

Thanks,


Roberto Franceschetti

LogSat Software

Roberto Franceschetti

LogSat Software

Spam Filter ISP
Back to Top
yapadu View Drop Down
Senior Member
Senior Member


Joined: 12 May 2005
Status: Offline
Points: 272
Post Options Post Options   Thanks (0) Thanks(0)   Quote yapadu Quote  Post ReplyReply Direct Link To This Post Posted: 05 April 2015 at 9:06am
Tomm,

I don't know how you are calculating the size of the message, but if you are sending a 3 meg attachment it will actually be larger than that.  The email client will convert it into a MIME encoded string and the size will increase by 30% or more, which would take it over your 30480 for sure.

--------------------------------------------------------------
I am a user of SF, not an employee. Use any advice offered at your own risk.
Back to Top
 Post Reply Post Reply
  Share Topic   

Forum Jump Forum Permissions View Drop Down



This page was generated in 0.063 seconds.