cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1253
Views
0
Helpful
3
Replies
Beginner

Deliver as attachment (RFC822) in virus scanning - what is the effect

Hi all,

I am attempting to understand the ramifications of configuring IronPort virus scanning to deliver a repaired, encrypted, or unscannable message as an RFC 822  attachment to a new message.  What kind of content would be potentially be lost?  We are specifically considering this option for encrypted messages; is there much advantage to that?

Thanks,

- Steve

Everyone's tags (1)
1 ACCEPTED SOLUTION

Accepted Solutions
Highlighted
Beginner

Deliver as attachment (RFC822) in virus scanning - what is the e

Hello Steve,

When choosing the "Deliver as Attachment(message/RFC822)" in your Cisco IronPort ESA anti-virus settings, no content will be lost. A complete copy of the message is simply attached to a new notification message.

The only exception is with the 'repaired' anti-virus settings. Regardless of the Action Applied to Message, 'repaired' messages will have the viral content removed. The content that is removed is typically a message attachment or URLs.

The 'encrypted' anti-virus setting only detects password protected or S/MIME messages. As mentioned, you would not lose any content if you chose the "Deliver as Attachment(message/RFC822)" for the 'encrypted' anti-virus settings.

Regards,

-Jerry

3 REPLIES 3
Highlighted
Beginner

Deliver as attachment (RFC822) in virus scanning - what is the e

Hello Steve,

When choosing the "Deliver as Attachment(message/RFC822)" in your Cisco IronPort ESA anti-virus settings, no content will be lost. A complete copy of the message is simply attached to a new notification message.

The only exception is with the 'repaired' anti-virus settings. Regardless of the Action Applied to Message, 'repaired' messages will have the viral content removed. The content that is removed is typically a message attachment or URLs.

The 'encrypted' anti-virus setting only detects password protected or S/MIME messages. As mentioned, you would not lose any content if you chose the "Deliver as Attachment(message/RFC822)" for the 'encrypted' anti-virus settings.

Regards,

-Jerry

Beginner

Deliver as attachment (RFC822) in virus scanning - what is the e

Hi Jerry,

Thanks for the explanation!

Best,

- Steve

I would like to know if we

I would like to know if we disable this rule, what else will be affected?