Deliver as attachment (RFC822) in virus scanning - what is the effect

[RSteveKadish]

Hi all,

I am attempting to understand the ramifications of configuring IronPort virus scanning to deliver a repaired, encrypted, or unscannable message as an RFC 822  attachment to a new message.  What kind of content would be potentially be lost?  We are specifically considering this option for encrypted messages; is there much advantage to that?

Thanks,

- Steve

[Jeronimo Orona · Accepted solution]

Hello Steve,

When choosing the "Deliver as Attachment(message/RFC822)" in your Cisco IronPort ESA anti-virus settings, no content will be lost. A complete copy of the message is simply attached to a new notification message.

The only exception is with the 'repaired' anti-virus settings. Regardless of the Action Applied to Message, 'repaired' messages will have the viral content removed. The content that is removed is typically a message attachment or URLs.

The 'encrypted' anti-virus setting only detects password protected or S/MIME messages. As mentioned, you would not lose any content if you chose the "Deliver as Attachment(message/RFC822)" for the 'encrypted' anti-virus settings.

Regards,

-Jerry

[RSteveKadish]

Hi Jerry,

Thanks for the explanation!

Best,

- Steve

[alpha.nscglobal]

I would like to know if we disable this rule, what else will be affected?