Fragmented emails are blocked

Unanswered Question
Jul 26th, 2010
User Badges:
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Andreas Mueller Mon, 07/26/2010 - 07:07
User Badges:
  • Silver, 250 points or more

Hello Wouter,

where do you see that the message is getting droppend, i.e. is the appliance not accepting it, or do the logs show anything? Maybe a filter that is active in the policy?



Cheers,

Andreas

axiosystems Mon, 07/26/2010 - 08:36
User Badges:

This is the mail we got:


This is an informative message sent by kerio.axio.be.


The server was not able to deliver your email message


  Subject: 'Axio Systems NONE explorer.2411b787.zone09-2010.07.26.09.01' (2 of 2)
  Date: Mon, 26 Jul 2010 11:02:51 +0200 (MEST)




to the following addresses:


  <[email protected]> (192.168.111.21: 554 5.7.1 Fragmented emails are blocked.)


192.168.111.21 is the ip address of our ironport.


Wouter

Andreas Mueller Tue, 07/27/2010 - 02:32
User Badges:
  • Silver, 250 points or more

Hello Wouter

"Fragmented emails are blocked" is not an IronPort error message, this message is given by postfix when a "Content-type: message/partial"
mail arrives.I believe this is some kind of Outlook functionality that splits messages with larger attachments into multiple parts, to get it trough gateways that have a size limit smaller than the attachment to be send. Obviously some mailserver do not like that because these splitted attachments can not be scanned for viruses.


According to Google Groups, this is the way to disable that functionality in Outlook:


Tools -> Accounts -> Mail -> Properties -> Advance


Uncheck: "Break apart messages........".



Regards,

Andreas

exMSW4319 Tue, 07/27/2010 - 12:44
User Badges:

We explicitly block message/partials, and have done for years for fear that it's theoretically possible to get a virus past a signature-based anti-virus check that way. Never had any complaints. Does anyone know if this is a groundless fear?

Actions

This Discussion

Related Content