User Tools

Site Tools


how_to:attachments_have_been_removed_or_renamed

Attachments have been removed or renamed

If you have received an email and one or more of its attachments have been removed or renamed, it might be a result of Attachment Filtering.

You can inspect the filtering rules by going to Administration Settings → Settings → Attachment Processing → Filtering

Double-extension

One common scenario is where dates or other bits of information are included in the filename and separated by dots. This could potentially trigger the following rule:

*.???.???

The rule detects a filename that ends in a dot, followed by three characters, followed by another dot, then three more characters. It is designed to prevent a common trick, where filenames are given a pretend extension, in front of the actual one. The trick is designed to make a recipient think a potentially malicious program is just a typical document. Anyone who is unfamiliar with the way filename extensions work in Windows may mistake that file.doc.exe is a Word document and run it.

Unfortunately, this also means that some legitimate files may be filtered. For example: a file named file2011.may.doc would look suspicious and therefore be filtered, according to that rule.

Workarounds

If your attachments are being filtered, there are a few options:

  1. You might want to ensure Change filtered attachment extension to make it unrunnable is selected in the filtering settings
    • This ensures the attachment is still accessible, but it would make it difficult for an inexperienced user to open the file.
    • In the rare cases that such an attachment is legitimate, the user can be shown how to save the attachment, rename and open the file.
    • The final character of the extension will be replaced with an underscore, so a Microsoft Word file named file.123.do_ would usually need to be renamed to file.123.doc
  2. Ask the sender to adjust the way they format their filenames. For example; when writing dates, hyphens (-) and underscores (_) are usually suitable alternatives to dots.
  3. Redirect all emails with filtered attachments, to a particular user.
    • In the filtering settings, select Redirect messages with filtered attachment to
    • Redirect the messages to a user who has a good understanding of Windows filenames and the sort of files you would expect to receive.
    • This user should then forward the messages, if appropriate, to the intended recipient.
  4. Remove or edit the rule that is filtering the attachment
    • This is not recommended, because it exposes users to additional potentially unsafe files. Nonetheless, if filtering is affecting productivity, it may be the only suitable option.
how_to/attachments_have_been_removed_or_renamed.txt · Last modified: 2018/11/14 10:45 by 127.0.0.1