|Email Plug-in (Reporting):||188.8.131.52|
|Email Plug-in (Encryption):||184.108.40.206|
Hi, We have a list of attachments blocked with the following message filter. However, would like to add a big list of attachment into the existing one.
Is there any best practice or recommended practice to block such a big list of attachments. Any help would be appreciated.
drop_malicious_attachment: if (recv-listener == "InternetMail") AND
The only alternative would be to use a dictionary to maintain the list of the file extensions.
The condition could then be modified to:
drop_malicious_attachment: if (recv-listener == "InternetMail") AND (attachment-filename-dictionary-match("Dictionary_Name"))
Dictionaries can be created from Mail Policies -> Dictionaries and they accept regex as well. I would recommend using quarantine action instead of drop for tesing out the filter.
There would not be much variation on the processing load of the filter, however it would make it easire to remove and add file extensions without having to modify the message filter each time.
Thanks. However, I noticed another thread on the same that suggests to go for filters with the list of attachment type directly.