Attach rar file in the mail

[daniel.ao_ironport]

My company IronPort has limited outgoing mail attachment size to 13MB. Recently, I found that when I send a mail attached with a rar file (10MB), the IronPort has detected the message size is over 13MB. Actually, the message body contains few words and the attachment size is around 10MB.

I don't understand why when I attach a rar file in the mail. the mail size will be increased around 33%. I also tried sending rar in yahoo mail and got the same results. Do anybody know the reason??

[Donald Nash]

Binary files must be BASE64 encoded before being sent via e-mail. BASE64 is a 6-in-8 encoding, meaning that the file size is increased by 33%. The RAR file may be only 10 MB sitting on your disk, but it's 13.3 MB once it has been encoded for transit.

[daniel.ao_ironport]

I've got it. Thank you very much.

[ezekiel_ironport]

Have a question here:

Let's say I want to completely remove executable, and I have policy to strip attachment file type executable.

How can I also strip the attachment if the executable is compressed (.zip or .rar)?

Will IronPort be able to detect? By binary?

Thanks,
ezekiel

[Donald Nash]

How can I also strip the attachment if the executable is compressed (.zip or .rar)?

This is a complicated question. A message filter can peek inside archive files, but not compressed solitary files. In other words, a .exe file inside a ZIP archive can be detected. But a .exe file that has been gzipped (file.exe.gz), will not be detected.

The full explanation is in the "Policy Enforcement" chapter of the Advanced User Guide.