Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Email Security Quick-links: ESA Product Support | SMA Product Support | Email Submission and Tracking Portal | Cisco SecurityHub
Current General Deployment (GD) Releases:
ESA: 11.0.0-264 WSA: 10.5.1-296 SMA: 11.0.0-115 Email Plug-in (Reporting): 1.0.1-048 Email Plug-in (Encryption): 1.0.0-036

New Member

Email becomes unreadible after going through Cisco email gateway

Hi all,

I have an issue with one sender who is trying to email password protected attachments to other staff in our organization.

The issue seems to only occur when the email goes through our C370, if he sends to an externally hosted email account the email and attachment can be opened, and when that email is then sent as an attachment back into our organization it is also openable, which seems to rule out our clients.

Sanitized header from the C370 below is part of the message header which I think might contain the problem, I have removed the first part with to & from as I didn't know if it was relevant..

Subject: Daily Subject
Thread-Topic: Subject
thread-index: Ac+JToaXaax6VYP2Qlaj21mbCsrr5w==
Date: Mon, 16 Jun 2014 10:36:28 +0000
Message-ID: <Message ID>
Accept-Language: en-GB, en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
X-Originating-IP: [192.168.30.71]
Content-Type: multipart/mixed;
        boundary="_005_B078E7CA8779484CB2961CF42F9F12481EE3C285RALXMBX01WHITSL_"
MIME-Version: 1.0
Return-Path: <sender@domain.uk>
X-OriginalArrivalTime: 16 Jun 2014 10:36:31.0542 (UTC) FILETIME=[D6741560:01CF894E]

This is a multi-part message in MIME format.

--_005_B078E7CA8779484CB2961CF42F9F12481EE3C285RALXMBX01WHITSL_
Content-Type: multipart/alternative;
        boundary="_000_B078E7CA8779484CB2961CF42F9F12481EE3C285RALXMBX01WHITSL_"


--_000_B078E7CA8779484CB2961CF42F9F12481EE3C285RALXMBX01WHITSL_
Content-Type: text/plain;
        charset="utf-8"
Content-Transfer-Encoding: base64

UGxlYXNlIHNlZSBhdGFjaGVkDQoNClJlZ2FyZHMNCg0KQWtlZW0gTGluc2V5DQoNCkFrZWVtIExp
bnNleQ0KV0hBQ1QgQ2FwYWNpdHkgVGVhbSBBZG1pbmlzdHJhdG9yDQpBY29uYnVyeSBFYXN0DQpX
b3JjZXN0ZXIgUm95YWwgSG9zcGl0YWwNClRlbDogMDE5MDUgNzYwMDY3DQpFbWFpbDogYWtlZW0u
bGluc2V5QGhhY3cubmhzLnVrPG1haWx0bzpha2VlbS5saW5zZXlAaGFjdy5uaHMudWs+DQoNClRo
ZSBpbmZvcm1hdGlvbiBjb250YWluZWQgaW4gdGhpcyBlbWFpbCBtYXkgYmUgc3ViamVjdCB0byBw

This string continues for 10's of lines

--_000_B078E7CA8779484CB2961CF42F9F12481EE3C285RALXMBX01WHITSL_
Content-Type: text/html;
        charset="utf-8"
Content-Transfer-Encoding: base64

PGh0bWw+DQo8aGVhZD4NCjxtZXRhIGh0dHAtZXF1aXY9IkNvbnRlbnQtVHlwZSIgY29udGVudD0i
dGV4dC9odG1sOyBjaGFyc2V0PXV0Zi04Ij4NCjxzdHlsZT4NCjwhLS0NCkBmb250LWZhY2UNCgl7
Zm9udC1mYW1pbHk6Q2FsaWJyaX0NCnAuTXNvTm9ybWFsLCBsaS5Nc29Ob3JtYWwsIGRpdi5Nc29O
b3JtYWwNCgl7bWFyZ2luOjBjbTsNCgltYXJnaW4tYm90dG9tOi4wMDAxcHQ7DQoJZm9udC1zaXpl
OjExLjBwdDsNCglmb250LWZhbWlseToiQ2FsaWJyaSIsInNhbnMtc2VyaWYifQ0KYTpsaW5rLCBz
cGFuLk1zb0h5cGVybGluaw0KCXtjb2xvcjpibHVlOw0KCXRleHQtZGVjb3JhdGlvbjp1bmRlcmxp
bmV9DQphOnZpc2l0ZWQsIHNwYW4uTXNvSHlwZXJsaW5rRm9sbG93ZWQNCgl7Y29sb3I6cHVycGxl

This string continues for 10's of lines

--_000_B078E7CA8779484CB2961CF42F9F12481EE3C285RALXMBX01WHITSL_--

--_005_B078E7CA8779484CB2961CF42F9F12481EE3C285RALXMBX01WHITSL_
Content-Type: application/vnd.openxmlformats-officedocument.spreadsheetml.sheet;
        name="16.06.14 test data.xlsx"
Content-Description: 16.06.14 test data.xlsx
Content-Disposition: attachment;
        size=21504;
        creation-date=Mon, 16 Jun 2014 10:35:56 GMT;
        modification-date=Mon, 16 Jun 2014 10:34:01 GMT;
        filename="16.06.14 test data.xlsx"
Content-Transfer-Encoding: base64

0M8R4KGxGuEAAAAAAAAAAAAAAAAAAAAAPgADAP7/CQAGAAAAAAAAAAAAAAADAAAAAQAAAAAAAAAA
EAAAAgAAAAEAAAD+////AAAAAAAAAAAHAAAACAAAAP//////////////////////////////////
////////////////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////////////
////////////////////////////////////////////////////////////////////////////
YhaetsvzHMi3ipkrNJSzrFVRN7+bX4l0BumhMZTII2xrE6oeB8hEqY8k2VbXv8U3HBd8J9RGVWDJ
SqZakOR/sQpgHLGkP6PAdRCn1DnGilooj9RrP4T0NjAipUVFMh82LbWeSHkYeF2odZvS9FDy4hCP
jz0oU3IWExxK67VOvELynIIGDs4OywbgzO1/umDQ5rzKg134XJcOCjZogzLN0aRirTBioH9/1JCq
CDi7xvoEUpPFjuNQt0xfVUV8fqr3fCzrKhhIAh7fo4FYVKHzS2lZkCXP+qLINNsBWDkb2WexmN6U
UrwbjQBNCKLKf2n46v1C

This string continues for 100's of lines


--_005_B078E7CA8779484CB2961CF42F9F12481EE3C285RALXMBX01WHITSL_
Content-Type: application/vnd.openxmlformats-officedocument.wordprocessingml.document;
        name="16.06.14 test document.docx"
Content-Description: 16.06.14 test document.docx
Content-Disposition: attachment;
        size=32566;
        creation-date=Mon, 16 Jun 2014 10:36:01 GMT;
        modification-date=Mon, 16 Jun 2014 10:33:24 GMT;
        filename="16.06.14 test document.docx"
Content-Transfer-Encoding: base64

UEsDBBQABgAIAAAAIQDwIex9jgEAABMGAAATAAgCW0NvbnRlbnRfVHlwZXNdLnhtbCCiBAIooAAC
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC0
lE1PwkAQhu8m/odmr6Zd8GCMoXBQPCqJGM/Ldgobux/ZWb7+vdMWGjRAUfDSpN193/fZ2c70Bitd
RAvwqKxJWTfpsAiMtJky05S9j5/jexZhECYThTWQsjUgG/Svr3rjtQOMSG0wZbMQ3APnKGegBSbW
gaGV3HotAr36KXdCfoop8NtO545LawKYEIfSg/V7T5CLeRGi4Yo+1yQeCmTRY72xzEqZcK5QUgQi
5QuT/UiJNwkJKas9OFMObwiD8b0J5crhgI3ulUrjVQbRSPjwIjRh8KX1Gc+snGs6Q3LcZg+nzXMl

This string continues for 100's of lines

--_005_B078E7CA8779484CB2961CF42F9F12481EE3C285RALXMBX01WHITSL_--

 

 

Below is the header when a copy is sent to Hotmail:

x-store-info: J++/JTCzmObr++wNraA4Pa4f5Xd6uensydyekesGC2M=
Authentication-Results: domain.com; spf=none (sender IP is IP Address) smtp.mailfrom=Sender@domain.uk; dkim=none header.d=domain.uk; x-hmca=none header.id=Sender@Domain.uk
X-SID-PRA: Sender@domain.uk
X-AUTH-Result: NONE
X-SID-Result: NONE
X-Message-Status: n:n
X-Message-Delivery: Vj0xLjE7dXM9MDtsPTE7YT0xO0Q9MTtHRD0xO1NDTD0w
X-Message-Info: NhFq/7gR1vQRHV6jbdvQfj78RRbHIsgK1hLH/9kB6NkUdTKzM/S60sw6uhmZk31ye2Ut7SsNRG194mNbBlVxpVFTOFvWOorYIP5ew8iIWHabwOUS2au4siXFpV/hL6TnYc2aLcBqOdiwZaz+fO5BeYoeCs9RYcubk1Jzn4Ff1TWTeX5PBOwirh+7vaICe5u9/LltrbQ5ODA+UL1EVPECVAszVGdCkiJ5
Received: from relayserver.uk ([62.208.144.128]) by SNT004-MC3F25.hotmail.com
 over TLS secured channel with Microsoft SMTPSVC(7.5.7601.22678); Tue, 17 Jun
 2014 02:22:01 -0700
Received: from blah.net (blah.net
 [IP Address]) by IMSVA80 (Postfix) with ESMTP id D712D448A3A for
 <recipient@domain.com>; Tue, 17 Jun 2014 10:21:59 +0100 (BST)
Received: from Blah.local (smtp.server [IP Address]) by
 blah.net (Postfix) with ESMTP id 5F6B6448F33 for
 <recipient@domain.com>; Tue, 17 Jun 2014 10:21:57 +0100 (BST)
X-PMWin-Version: 3.0.2.0
X-MimeOLE: Produced By Microsoft MimeOLE V16.4.3528.331
Received: from blah.local ([192.168.46.221]) by
 Blah.blah.local with Microsoft SMTPSVC(IP address); Tue, 17 Jun 2014
 10:21:36 +0100
Received: from Server name ([fe80:::::822d]) by
 Exchange server name ([192.168.46.221]) with mapi id 14.02.0342.003;
 Tue, 17 Jun 2014 10:21:36 +0100
From: "Surname, Firstname" <Sender@Domain.uk>
To: <Recipiant@domain.com>
Subject: Subject
Thread-Topic: Subject
thread-index: Ac+JToaXaax6VYP2Qlaj21mbCsrr5wAvrAhgAAASClA=
Date: Tue, 17 Jun 2014 09:21:35 +0000
OLD-MSG-ID: <Old Message ID>
Accept-Language: en-GB, en-US
Content-Language: en-US
X-MS-Has-Attach: yes
X-MS-TNEF-Correlator:
X-Originating-IP: [192.168.30.85]
Content-Type: multipart/mixed;
 boundary="----=_NextPart_000_0002_01CF8FA3.87849CD0"
MIME-Version: 1.0
X-OriginalArrivalTime: 17 Jun 2014 09:21:36.0838 (UTC) FILETIME=[89D06E60:01CF8A0D]
Message-ID: <Message ID>
X-TM-AS-Product-Ver: IMSVA-8.0.0.1495-7.5.0.1017-20762.006
X-TM-AS-Result: No--42.282-60-31-10
X-imss-scan-details: No--42.282-60-31-10;No--42.282-3-31-10;No--42.282-4-31-10
X-TMASE-MatchedRID: JcGkxUY+Fi9XTuUjTP3HupObxJgN/hOxOhJ9m53n4aDIGC/aFIx4/sEhNzkwL19YZrHSGmcb0tPNR6N8PNUm3hQ3/xoDO/IlaK+MsTwM+1nP60q/FX5hsL40mI6UpXzvoYk2ByBT6IRl+EcAbF0M2///m9pcIDdz1kpuPUtox1KS2fL5IypDsYEcpMn6x9cZ67hywNgiYt0GLHHeUCuj17PllCNDDbY+2BJ2fZa5f2xqeX9tIrexd/jQkA7rdCuFfMhjt3b5PP1K0WT/zXAgkpjaylIY/e3Y9hU4NdzeECk8LuP+bOkMWt3jF2fVcPdzDB+ErBr0bANar2Wff4KSIaUXswX/xrISOe5BYzkyOSWATHNX4n1dGGZBslDPcF5vyAzYZQWW+9rbH8WaUL9qjLTxnpbCjruIowtRP8whCK8PmNN74zkTtDMO4HIvV/eCHcN4x+ltYL371rCnW2Nmh+V1K1TQIEH5D+WFNKXSJkRkYpwdTJ43fZUdXE/WGn0FVmA9rBozNAcLEpo317bQY8H9mYPMZJ+SW8KeTXPQ6zqOhzOa6g8KrXacDQD1LjGG8gyxx3MD7IZOuMJDRGZYWM2dM+bCCs0tT+iWcZL4Ksw=
X-Hotmail-VirusCheck: Clean
Return-Path: <Sender@Domain.uk>

 

The sender has advised they are using Outlook 2010.

Thanks in advance for any help working out why the email cant be read when coming in through our C370 gateway & sorry if posted in wrong community

 

Katie

Everyone's tags (1)
1 REPLY
Cisco Employee

Hi,Could you please try to

Hi,

Could you please try to put another DNS server on the ESA? Like ISP's DNS or a public one.

Luis Silva

Luis Silva "If you need PDI (Planning, Design, Implement) assistance feel free to reach us" http://www.cisco.com/web/partners/tools/pdihd.html
282
Views
0
Helpful
1
Replies