Print Page | Close Window

Attachments not blacklisted

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
Printed Date: 18 February 2019 at 7:44pm

Topic: Attachments not blacklisted
Posted By: Tomm
Subject: Attachments not blacklisted
Date Posted: 26 March 2015 at 12:00am
Hi All,

We've recently started blacklisting by attachment matching "*.zip" due to a spate of new spam with viruses in zip files.

However, emails with zip attachments are still getting through, the log entry is "Whitelisted - Email size exceeded MaxMsgSizeForSpamFiltering"

That test email was only 3MB altogether. The size listed on the Configuration Tab for "Max email size in KB" is 30480.

Please help me understand this.

Version is

Posted By: LogSat
Date Posted: 26 March 2015 at 12:31am

We're not able to replicate the issue - sending a test email with a .zip attachment that is 4MB in size, with the SpamFilter.ini containing this value:


does result in the email being quarantined:

03/26/15 00:22:59:187 -- (18662720) Connection from:  -  Originating country : N/A
03/26/15 00:22:59:328 -- (18662720) Received MAIL FROM:
03/26/15 00:22:59:328 -- (18662720) Received RCPT TO:
03/26/15 00:23:02:343 -- (18662720) Found Keywords: [Found prohibited attachment: complete network spam]
03/26/15 00:23:02:343 -- (18662720) EMail from to matches content filter rules - rejected.
03/26/15 00:23:03:218 -- (18662720) Starting quarantine procedures
03/26/15 00:23:03:234 -- (18662720) Created thread (18558800) to add email to quarantine
03/26/15 00:23:03:234 -- (18558800) Adding to Quarantine file:QrtnBEAD2701-839F-40DA-9F95-11DEEA02E79C.tmp
03/26/15 00:23:03:250 -- (18662720) Disconnect
03/26/15 00:23:03:484 -- (18558800) EMail from to was received and quarantined. Size: 3980 KB, 4075520 bytes

Can you please zip us the following so we can take a better look:

• SpamFilter's activity logfile for today (or a day this happened)

• The email that was delivered - please include the email as an attachment, not forwarding it to us "inline" via email so as to retain the original message format

• Your SpamFilter.ini file

• The \SpamFilter\Domains directory structure (if the files containing any of your blacklists/whitelists are outside that directory tree, please include those as well.

If the zipped file is over 8MB in size, please try to upload the file to our repository - I'll send you the URL/password in a separate PM.



Roberto Franceschetti

LogSat Software

Roberto Franceschetti" rel="nofollow - LogSat Software" rel="nofollow - Spam Filter ISP

Posted By: yapadu
Date Posted: 05 April 2015 at 9:06am

I don't know how you are calculating the size of the message, but if you are sending a 3 meg attachment it will actually be larger than that.  The email client will convert it into a MIME encoded string and the size will increase by 30% or more, which would take it over your 30480 for sure.

I am a user of SF, not an employee. Use any advice offered at your own risk.

Print Page | Close Window