Our company has a MS Exchange 2007 server and it also uses the Barracuda Spam appliance. We are having a problem and I would like to request your assistance, to solve this problem. The problem has to do with a email source - the CPA of our company. In the last two weeks he have sent three emails with some attachments to the board of directors (About 7 people) and what happens is that the email is received by all of the members of the board of directors without the attachments. The email looks normal and there are not errors or messaging saying anything about the attached files - When checking the Barracuda Spam appliance I am able to see the email, including all of the attached files in it, with a message "Queued mail for delivery" as shown in the barracuda heather down below. The Barracuda Spam is sending the message to the exchange server but for some reason, the exchange server is stripping the attached files from the email and it is sending the email to the members of the board. One more piece of information - The name of the CPA contains the letter "sex" as part of his name. I checked the exchange server and I have no idea what else to do. Any suggestions, comments on how to find the root cause of the problem, or how to fix this problem are welcome. From: nameSexlast@cpaname.com Time: 2011-03-31 08:49:28 To: name@domainname.com Action: Allowed Subject: FW: Revised subject Reason: Message Size Size: 406837 Score: Source IP: adsl-69-215-42-238.dsl.chcgil.ameritech.net[69.215.42.238] Delivery Status: Delivered ID: 1301579368-1534955a0001-FfzNt9 Delivery Detail: 250 2.6.0 <51C0C1C3DC40C944899F1CEB451EE2A10B87EA@SBS1.cpaname.local> Queued mail for delivery Thank you!

Some questions that may help. What type of attachment is it? What is the attachment name? What do the Exchange tracking logs tell you about the size of the message when received there? Do you have any attachment filtering configured on the Exchange server either via the Edge Transport role or a 3rd party product such as Ninja/Vipre or SMSMSE?

I don't think this issue is due to it being marked as SPAM since if it were, then the whole email would be rejected/quarantined, not just the attachment. Actually Anti-Virus filtering can do this. If I'm not mistaken, Forefront for Exchange can filter out "bad" attachments but let the email through so I'm guessing more applications can to roughly the same. Do you have any Anti-Virus filtering besides SPAM filtering? And the suggestion from RStovall (looking into the Message Tracking logs) is also a good thing to check.Jesper Bernle | Blog: http://xchangeserver.wordpress.com

Thank you very much for your assistance. To answer your questions: The attachments are word and excel documents! The names are Review.xls, review.doc. The size is about 406kb. No attached filters.

Do you have any Anti-Virus filtering besides SPAM filtering? You didn't answer my question though.Jesper Bernle | Blog: http://xchangeserver.wordpress.com

What is the mime type of the attachment after going through the spam filter? Somtimes they get converted from say application/xls to say application/octet-stream because the AV/spam filter didn't correctly identify the mime type. When that happens, application/octet-stream is blocked by default. Indeed you want that blocked, otherwise it would be a security hole. John

Can you see the attachment when using OWA? If you can then the issue is a MIME type issue.

Hi 1. Checking configuration of hub transport Attachemnt Filtering agent. John and Mike also mention MIME type email. You can read this blog. 2. You can do many tests. You can rename/compress attachment and send it to yourself again. Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hi Do you have anything to update your issue?Please remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

A real-time block list (RBL) is a method of stopping spammers from being able to send out large quantities of distasteful spam. A real-time block list is managed and maintained by an organization (company, non-profit, or volunteers) who track spam activity and create a list of known violators. Violations can include SMTP configurations to being caught sending spam. Once you are on their list, you can typically request removal. Some site will publish email addresses and all messages received to that email address is spam. When a computer connects to your Exchange server, Exchange will query the specified real-time block list. If the address is on that list, Exchange will generate an error and refuse the message. The server that was trying to send the spam is then responsible to generate a non-delivery report and send it the sender. This will eventually lock up the sending server until their open relay is detected and resolved. For a list of real-time block lists, please refer to the Wikipedia article: http://en.wikipedia.org/wiki/Comparison_of_DNS_blacklists Setup The process is the same for Exchange 2008 and Exchange 2010. To setup a RBL, open Exchange Management Console – the GUI, and under Organization Configuration select Hub Transport. Select the Anti-Spam tab and right click IP Block List Providers selecting Properties. Shawn Zernik Internetwork Consulting