MS Exchange Problem receiving attached file!
Our company has a MS Exchange 2007 server and it also uses the Barracuda Spam appliance. We are having a problem and I would like to request your assistance, to solve this problem. The problem has to do with a email source - the CPA of our company. In the last two weeks he have sent three emails with some attachments to the board of directors (About 7 people) and what happens is that the email is received by all of the members of the board of directors without the attachments. The email looks normal and there are not errors or messaging saying anything about the attached files - When checking the Barracuda Spam appliance I am able to see the email, including all of the attached files in it, with a message "Queued mail for delivery" as shown in the barracuda heather down below. The Barracuda Spam is sending the message to the exchange server but for some reason, the exchange server is stripping the attached files from the email and it is sending the email to the members of the board. One more piece of information - The name of the CPA contains the letter "sex" as part of his name. I checked the exchange server and I have no idea what else to do. Any suggestions, comments on how to find the root cause of the problem, or how to fix this problem are welcome. From: nameSexlast@cpaname.com Time: 2011-03-31 08:49:28 To: name@domainname.com Action: Allowed Subject: FW: Revised subject Reason: Message Size Size: 406837 Score: Source IP: adsl-69-215-42-238.dsl.chcgil.ameritech.net[69.215.42.238] Delivery Status: Delivered ID: 1301579368-1534955a0001-FfzNt9 Delivery Detail: 250 2.6.0 <51C0C1C3DC40C944899F1CEB451EE2A10B87EA@SBS1.cpaname.local> Queued mail for delivery Thank you!
April 1st, 2011 4:15pm

Some questions that may help. What type of attachment is it? What is the attachment name? What do the Exchange tracking logs tell you about the size of the message when received there? Do you have any attachment filtering configured on the Exchange server either via the Edge Transport role or a 3rd party product such as Ninja/Vipre or SMSMSE?
Free Windows Admin Tool Kit Click here and download it now
April 1st, 2011 7:22pm

I don't think this issue is due to it being marked as SPAM since if it were, then the whole email would be rejected/quarantined, not just the attachment. Actually Anti-Virus filtering can do this. If I'm not mistaken, Forefront for Exchange can filter out "bad" attachments but let the email through so I'm guessing more applications can to roughly the same. Do you have any Anti-Virus filtering besides SPAM filtering? And the suggestion from RStovall (looking into the Message Tracking logs) is also a good thing to check.Jesper Bernle | Blog: http://xchangeserver.wordpress.com
April 1st, 2011 11:21pm

Thank you very much for your assistance. To answer your questions: The attachments are word and excel documents! The names are Review.xls, review.doc. The size is about 406kb. No attached filters.
Free Windows Admin Tool Kit Click here and download it now
April 1st, 2011 11:32pm

Do you have any Anti-Virus filtering besides SPAM filtering? You didn't answer my question though.Jesper Bernle | Blog: http://xchangeserver.wordpress.com
April 2nd, 2011 2:15pm

What is the mime type of the attachment after going through the spam filter? Somtimes they get converted from say application/xls to say application/octet-stream because the AV/spam filter didn't correctly identify the mime type. When that happens, application/octet-stream is blocked by default. Indeed you want that blocked, otherwise it would be a security hole. John
Free Windows Admin Tool Kit Click here and download it now
April 2nd, 2011 9:51pm

Can you see the attachment when using OWA? If you can then the issue is a MIME type issue.
April 3rd, 2011 6:00pm

Hi 1. Checking configuration of hub transport Attachemnt Filtering agent. John and Mike also mention MIME type email. You can read this blog. 2. You can do many tests. You can rename/compress attachment and send it to yourself again. Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
Free Windows Admin Tool Kit Click here and download it now
April 4th, 2011 8:46am

Hi Do you have anything to update your issue?Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
April 7th, 2011 10:54am

A real-time block list (RBL) is a method of stopping spammers from being able to send out large quantities of distasteful spam. A real-time block list is managed and maintained by an organization (company, non-profit, or volunteers) who track spam activity and create a list of known violators. Violations can include SMTP configurations to being caught sending spam. Once you are on their list, you can typically request removal. Some site will publish email addresses and all messages received to that email address is spam. When a computer connects to your Exchange server, Exchange will query the specified real-time block list. If the address is on that list, Exchange will generate an error and refuse the message. The server that was trying to send the spam is then responsible to generate a non-delivery report and send it the sender. This will eventually lock up the sending server until their open relay is detected and resolved. For a list of real-time block lists, please refer to the Wikipedia article: http://en.wikipedia.org/wiki/Comparison_of_DNS_blacklists Setup The process is the same for Exchange 2008 and Exchange 2010. To setup a RBL, open Exchange Management Console – the GUI, and under Organization Configuration select Hub Transport. Select the Anti-Spam tab and right click IP Block List Providers selecting Properties. Shawn Zernik Internetwork Consulting
Free Windows Admin Tool Kit Click here and download it now
July 12th, 2011 8:47pm

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics