IronPort Not Seeing Attachments in a Rich Text Format

[anotthak8]

Hello,

I am just curious as to why the IronPort does not see attachments that are in a email which is in rich text format? For example, a user is sending us an email with a PDF in the body of the email, not attached. When I look at the message details, it only shows the message contained a winmail.dat file, no PDF.

Thank you in advance!

[dmccabej · Accepted solution]

Hello,

This is a setting that can be modified within Exchange to remove the addition of the Winmail.dat attachments.

You can read more about this here in our KB : Troubleshooting winmail.dat Attachments

Hope that helps!

Thanks!

-Dennis M.

[Libin Varghese · Accepted solution]

The Winmail.dat file is just used to preserve Rich Text formatting. Outlook uses it when sending a Rich Text-formatted message.

https://support.microsoft.com/en-us/kb/278061

If you are looking to being able to read the file and pull attachment names out of the .dat file itself, this is not something that the appliance will be able to do. This is a proprietary file format that we will not be able to analyze.

Unfortunately the message tracking details will only show the top level attachments in a message. Other attachments contained within a container file format such as .zip or winmail.dat (MS-TNEF) will not be shown in message tracking.

Here is a link with more information regarding ms-tnef:

http://kb.mozillazine.org/Winmail.dat_attachments

An internal feature request was filed to allow this capability (Show contents of winmail.dat in message tracking), but there is not going to be a way to access this without this functionality.

Regards,
Libin V

[Philippe Boeij · Accepted solution]

Yes, additional info: luckily Sophos does scan inside the winmail.dat file.

I was testing the Ironport AMP feature and found out that a virus in a winmail.dat is being ignored by AMP (it's also not uploaded). If Sophos doesn't recognize it, it will be delivered to the end user....