Messaging Gateway

We receive many encrypted attachments that are legit, but also an increasing number that are viruses. And we can't block all encrypted attachments because we need to receive the important ones. So we have configured the malware policy to hold all e-mails with encrypted attachments to the Spam Quarantine, and we have to check and release the "good" e-mails manually from the Quarantine every day. This makes us a lot of stupid work.

The Reputation-List ("Local Good Sender Domain") will not work to bypass the malware scanning.

It is possible to make an improvement here? In Example, move the "encrypted Attachments"-Rule from the "Malware"-tab to the "Content"-tab, so I can create a Dictionary with "good" senders which the "encrypted"-Rule can be skipped?

Best Regards

Rolf

Hi Rolf,

You could try adding a custom header field, eg x-custom: encrypted within malware detection for encrypted attachment and go on with content rules.

I havent tried it in that special case but i use it with spf-soft and hardfails and exceptions for that.

Regards

Thomas

Hi,

unfortunately that does not work. I had already received this proposal from the Symantec Support, but they have revoke it on the same day.

My tests confirm that it does not work that way.

The Problem is the malware filter (especially encrypted attachment filter) and the content filter rules cannot be combined, because the processing is not in succession, but instead in parallel (multitasking).

Regards

Rolf