Spamblocker Stripping PDF files from incoming emails
I have a Firebox T55-w with version 12.7 os. When I enable Spamblocker I am just using it for pop email to tag it as we have no internal email server. All pdf files get removed on incoming messages and replaced with winmail.dat file has been removed in message.txt file that has replaced the pdf. I have seen some info about setting in smtp-proxy to add x-ms-has-attach:* + 2 other rules but I am using pop. I tried adding a file exception in the pop policy to ignore *.pdf files but it had no effect. Is there a way to stop all stripping of attachments to avoid this issue or what changes to fix this in my pop settings.
I disabled the Gateway Antivirus but this had no effect as well.
I have been looking but have not found much information. Thanks for your help in advance.
Gary
Comments
A winmail.dat attachment is caused by Outlook when users select Rich Text format for the sent mail.
The SMTP proxy and the POP3 proxy do not cause a winmail.dat attachment.
The SMTP proxy can strip a winmail.dat attachment.
I have not seen a POP3 proxy strip a winmail.dat attachment or a .pdf file, so I don't have an immediate suggestion as to the cause.
Please post a sample contents of the message.txt contents or other info, such as Traffic Monitor log entries which show what is stripped and perhaps why.
See this MS article on the cause of a winmail.dat file in a sent e-mail:
How email message formats affect Internet email messages in Outlook
https://support.microsoft.com/en-us/topic/how-email-message-formats-affect-internet-email-messages-in-outlook-3b2c0536-c1c0-1d68-19f0-8cae13c26722
I read the document you linked too above before about the winmail.dat
The pop proxy does not have the same settings for winmail.dat issue.
I seem to get the 2 messages below depending on the email. One is about winmail.dat and the other is just removing pdfs. (See Below)
I captured the traffic monitor log but not sure what I should be looking for in it, or if I should post that info. (i did not see any info about removing an email attachment)
The WatchGuard Firebox that protects your network has detected a message that may not be safe.
Cause : The message content may not be safe.
Content type : application/pdf (auto detected)
File name : Townhouse Proposal - 2020-10-16 .pdf
Virus status : No information.
Action : The Firebox deleted Townhouse Proposal - 2020-10-16 .pdf.
Recovery : cannot restore
Also get this:
The WatchGuard Firebox that protects your network has detected a message that may not be safe.
Cause : The message content may not be safe.
Content type : application/vnd.ms-tnef (auto detected)
File name : winmail.dat
Virus status : No information.
Action : The Firebox deleted winmail.dat.
Recovery : cannot restore
Not sure if these lines from traffic monitor have any value on this issue.
2022-01-13 14:11:47 wgagent could not get xml string
2022-01-13 14:11:47 wgagent config file can't find the node.
2022-01-13 14:11:48 wgagent failed to find node /profile/system-parameters/apt
You need to allow the 2 Content Types on your POP3 proxy action in Content Types.
Specify an Exact Match on the new Allow entries for application/pdf and for application/vnd.ms-tnef
Hi,
I added the exact match new allow entries as suggested then the message below was inserted.
I have set the action to take if no rule above is matched to allow rather than strip and I am having the same issue.
application
The WatchGuard Firebox that protects your network has detected a message that may not be safe.
Cause : The file type may not be safe.
Content type : application/ms-tnef
File name : winmail.dat
Virus status : No information.
Action : The Firebox deleted winmail.dat.
Recovery : cannot restore
Action = Allow
Thanks Bruce... Everything seems to be working correctly now...