cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
541
Views
0
Helpful
1
Replies

Blocking .eml file type

Tony Kilbarger
Level 1
Level 1

For a long time we have blocked ".eml" attachments by extension for some email domains.  With the advancements in scanning techniques by the various filters in CES, what would be the risk of removing this?  Would a ".eml" attachment be scanned just as the base email is scanned?  

Looking for input to weigh risk.

 

1 Reply 1

As far as I have seen, it's treated as an attachment, not another email, so URL rewrites etc will not happen. We have seen them try to use emais as attachments to try to pass along malicious URLs and attachments in that email instead.

 

Personally, I would leave them blocked unless there is a really good reason.

 

To be sure, you can look at logs of an example email as it should still pass through spam, AV etc before being removed by a filter.