Incoming Mail not arriving, attachments stripped

[emagineering]

One of the mail domains we host is reporting mail sent from various vendors (expedia,etc) is not arriving.Other mail is arriving to them without issue.
What would cause these particular emails to NOT be delivered, we have included the sending domains in question to be excluded from spam filtering.

Also, the same account is reporting issues with attachments being stripped......a recent notification:
The following attachments were removed from this message:
UNKNOWN_PARAMETER_VALUE
We are using the preset attachment blocking and removal of winmail.dat

[Code Crafters]

You should look at the SMTP logs to see what errors are given for any mail delivery. If you let me know any of these errors I can point you at what triggered them and help you resolve them. You can put the domain as white listed for SPAM filtering but then you may actually get more SPAM from unauthorised senders that SPF etc would stop. Content filtering can of course also be white listed using the stop filtering action to stop further rules from being executed if SMTP Sender CONTAINS domain.com or similar.

[ehavemann]

Once in a while (like right now) I get the same problem, only I don't have ANY rules that block attachments. I just missed two emails, one with a .TXT attachment and one with a .XLS attachment, both from a white-listed domain. I get the email itself, just not the attachments. Even the sender's corporate .jpg logo is stripped from his email.

The following attachments were removed from this message:
image001.jpg
Important File.xls
For more information, please contact the administrator.

[Code Crafters]

The above message shows that antivirus filtering triggered to remove the selected attachments. If you are sometimes getting attachments wrongly removed, you can get round this by either making a copy of the original mail stored into another account for recovery or make a copy of the removed attachments to a specific folder directly for recovery if needed. Only open these if you are very confident that they are in fact not infected otherwise you could spread the infection.

[ehavemann]

Here is another one I got today. The message (with intact attachments) was originally sent from an outside sender to someone@domain.com (which is our own AMS-hosted domain) without a problem, and subsequently forwarded to me@domain.com. The forwarding sender (someone@domain.com), our AMS server, and me@domain.com are all on the same local subnet.

The message (with intact attachments) appears in someone@domain.com's "Sent" folder as viewed from their AMS Webmail account in the "Sent" folder. The Webmail "Attachments:" line there shows file1.jpg, file2.gif, file3.xls, file4.xls, and file5.ppt. All five attachments open up there without a problem.

But in me@domain.com's AMS webmail Inbox I get the following:
Attachments: removed_attachments_20090324133711.txt, 1_3_00000892.dat, 2_00023246.dat, 3_00009525.dat, 4_00009626.dat

The following attachments were removed from this message:
file1.JPG
file2.gif
file3.xls
file4.xls
fle5.ppt
For more information, please contact the administrator.

All five of these are innocuous and safe files that should not have triggering any attachment removals. And if they did, then I have custom filtering rules in place that would direct the entire mail (attachments intact) to an alternative account, with an email message sent to me regarding the potential virus.

Our hardware firewall is not configured to remove any attachments, and even if it was, the traffic from someone to me via AMS Server would not have passed through it in this case.

My AMS antivirus configuration is as follows:
--> Mail Destination: Scan All Mail
--> Extra Scanning Options: Scan Raw Email body AND Scan Text/HTML Body Parts
--> AntiVirus scanner: Sophos...
--> Option checked: "Return Value" (NOT "File Deletion")
--> Checked: "Hide Scanner Application Window"
--> Checked: "Classify File as Virus if Application Fails"
--> Actions:
1 - Redirect to virus@domain.com
2 - Send emailto me@domain.com with subject "Email virus flagged"

someone@domain.com's machine is using Outlook 2003 as the mail client. I do not know offhand if there is an antivirus program running on the sender's machine, but their attachments made it both into their Outlook Inbox via AMS POP3, and back out to their AMS webmail "Sent" folder (since Outlook is configured to use AMS as SMTP). So I have no idea what mechanism is stripping these attachments, and why.

[Code Crafters]

1) Uncheck the option "Classify File as Virus if Application Fails" so that if the antivirus application is inaccessible files aren't automatically classified as infected.
2) I actually now think it looks like you might have added the default content filter rule for Attachment Blocking which only allows certain attachments and blocks all others. Check if this rule is present and try disabling or changing the attachment list to see if this solves the problem.