Question

Locked

Exchange 2003

By retro77 ·
Ok, my turn. I have an Exchange 2003 server and I have a couple of instances where a PDF attachment is getting stripped. This is when one of my internal users sends out. But when the user sends to my external email, I get attachment just fine.

I am also running GFI Mail Essentials, but as far as I know, thats only monitoring inbound.

Is there way that I can prove that my server is seeing the attachment and sending it one? i am 99.999% positive its on the destination end.

Thanks!

This conversation is currently closed to new comments.

10 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Answers

Collapse -

If you receive the attachment

by Tig2 In reply to Exchange 2003

Then the attachment MUST be stripped at the receiving end. The fact that it is received at your external address tells you that.

If your user were to send it to the destination's Internet mail, it would be received. I don't know of any Internet mail clients (such as gmail, Yahoo, etc) that strip attachments of any sort. But I know a lot of corporate mail systems that do.

I would hazard that the user's mail log should indicate if the message was sent with an attachment.

Collapse -

Thats What My Gut Tells Me

by retro77 In reply to If you receive the attach ...

That the issue is the recipient. I just gotta have my ducks in a row so that I can toss the ball back in the other sides court.

Thanks.

Collapse -

Logs

by Tig2 In reply to Thats What My Gut Tells M ...

But better yet, a test. Have your user send it to the destination's Internet mail. Make sure that it is not proprietary information or send an innocuous brochure. If the destination receives it, you have your proof. Undeniable.

Collapse -

My second test

by retro77 In reply to Logs

Here is what I did, I renamed the attachment to take out '(' and a '+'. The destination received it. Took him 2.5 hours to respond with this: 'GOT IT'. Didnt tell me what attachment he received. I sent a reply.

Anyone heard of mail servers stripping based on characters like '(' and '+'?

2 Thumbs Up TiggerTwo! Thanks!

Collapse -

Sure

by Tig2 In reply to My second test

They may be stripping out all "special" characters in an effort to avoid hidden code.

The destination IT shop should be able to clarify their mail rules for you. That way, your user can send this file and still be in compliance.

Good job with tracking this!

Collapse -

You would think

by retro77 In reply to Sure

But the destination IT isn't the smartest bunch of kids. One of the IT people I talked to receives all the email for the company in one mailbox and he prints it out and takes it to the person it was destined for. Can you imagine? This is flippin 2007, almost 2008!

Oh and I sent this same kid, both an attachment with the ( and the + in the filename as well as with out, he got both! Why? Why would he get both? Its totally inconsistant!

I never heard back from my 'GOT IT' guy.

Collapse -

Can you trace the message path through the mime headers?

by ManiacMan In reply to Logs

That's the best way to see what SMTP gateways the message traversed. It's kind of like a tracert for mail messages.

Collapse -

Ok

by retro77 In reply to Can you trace the message ...

When I send it to my Gmail account, I get something like this:

from mailserver.mydomain.com (mailserver.mydomain.com [www.xxx.yyy.zzz])
by mx.google.com with ESMTP id a16si1812673rof.2007.12.06.08.40.12;

Is that what you are talking about?

Collapse -

I'm not familiar with GFI, but I've deployed similar products

by ManiacMan In reply to Exchange 2003

that run at the SMTP gateway level as smart hosts and have rules established to strip off attachments based on a specific set of criteria. This can be done to prevent internal documents from being leaked out via email and other reasons due to regalatory requirements and such. I've seen such things done with document management solutions in which a user would select whether the attachment is being sent to an internal or an external contact and if external, the email was sent out signed and encrypted using SHA1 and 3DES.

Collapse -

Ok

by retro77 In reply to I'm not familiar with GFI ...

GFI does have a place for monitoring outbound email, but there are no rules applied. I unchecked the Monitor Outbound box just in case.

Back to Networks Forum
10 total posts (Page 1 of 1)  

Related Discussions

Related Forums