Skip to main content

Server flagging email attachments as winmail.dat

keat63
I had users complaining that my internal firewall was stripping out file attachments from emails. When I checked, these files were winmail.dat. Looking in CSF Mailscanner to see what they actually were, and MailScanner was also reporting them as winmail.dat. ??? I restarted exim and mailscanner, and now new files are being reported correctly, as DOCX or XLXS. (the old ones still show in MailScanner as winmail.dat) However, now that this is corrected, my internal firewall is blocking DOCX and XLXS with a Content type : application/vnd.openxmlformats-officedocument.wordprocessingml.document I've absolutely no idea what just happened. Why would my server flag these as winmail.dat, and then why would my internal firewall start stripping out xlxs and docx immediately after.. Two totally independant devices at different locations at the same time ? Since writing, I added XLSX and DOCX to my internal firewall rules, to be virus scanned and these are passing through the firewall also. These have never been an issue until around 10:30 this morning, so as you can imagine, I'm a tad confused as to what just happened.

Comments

4 comments

Date Votes
  • cPanelMichael
    Hello @keat63, Can you share the log output in /var/log/exim_mainlog for one of the affected messages? To do this, find the message ID in the email's header and then search for it using the following command: exigrep $MSGID /var/log/exim_mainlog
    Thank you.
    0
  • keat63
    It's been and gone now and I moved on to something else. :) I suspect the issue was with Mailscanner initially. Then possibly a rogue setting in my internal firewall which had been checked but unsaved. A combination of my actions, trying to determine the cause, which coincidentally looked to be related.
    0
  • keat63
    Searching for an answer to an issue I'm seeing (again aparrently) and came across my old thread. Only after finding this thread, do I vaugely recall having this issue in the past. On this occasion, the file the guy is trying to send is a PDF. 2020-03-16 13:53:04 1jDqAy-0007QD-OF <= Paul@xxxxxxx.com H=mail2.xxxxxxxxx.com [195.224.xxx.xxx]:37405 P=esmtps X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no S=145919 id=5ee102396e01445385ba735f107e4490@xxxxxxx.com T="POP Order" for me@me.co.uk 2020-03-16 13:53:09 1jDqAy-0007QD-OF => sales R=virtual_user T=dovecot_virtual_delivery C="250 2.0.0 wmqTH8WEb17CbwAAejhMJg Saved" 2020-03-16 13:53:09 1jDqAy-0007QD-OF Completed
    This evening I've restarted mailscanner and exim, and I'll ask the guy to resend his email tomorrow, but in the meantime, any thoughts ?
    0
  • keat63
    It happened again yesterday. I've posted a question on the CSE forum, as I suspect that it's potentially mailscanner related. (maybe i'll disable mailscanner temporarily to prove, if it happens again in the coming days)
    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post