Attachment Filtering
Attachment filters can identify file attachments using several different methods - file extension, file name, file type and MIME type.
Go to Filtering > Attachments to manage your attachment filters.
The different type of filters are
Extension Filters
An extension filter extracts a file attachment extension using an email's MIME headers and applies a decision based on the extension filter settings.
Go to Filtering > Attachments and select the Extension Filters tab. Extension filters that have been created at a higher level of access and applied to your domain(s) are displayed with "(inherited)" following the filter name – for example, js (inherited).
After creating or editing a filter, or number of filters, select Apply Filters to apply the filters to your mail. This button is not available for five minutes after selection.
| Caution: If a filename extension has been modified, it may not be recognized by an extension filter. For example, if an executable file, photo.exe, has been renamed to photo.jpg, an .exe extension filter will not detect this change. In this situation, a File Type Filter and/or a MIME Type filter are also necessary. |
Creating an Extension Filter
- Go to Filtering > Attachments and select the Extension Filters tab.
- Select Create and the Create An Extension Filter window displays.
- Extension: Enter a file extension. Only alphanumeric characters are allowed for filename extensions.
- Inbound action: Select the action to take on inbound emails that match this filter:
- Allow: Allow the email.
- Block: Block the email.
Note: The domain or user policy determines if the message is quarantined. Go to Policies > Domain Policy or User Policies.
- Ignore: Take no action.
- Scan Archives: Select if you want this filter to match files contained within compressed archive files.
- Scan Double Extensions: Select to identify attachments that have been renamed to conceal their true type, as double extensions can be used to trick a user into opening malware. A mail client may hide a second extension, so filename.gif.exe appears as filename.gif.
- Comments (optional): Enter optional comments about this extension filter.
- Select Create or save this extension filter or Cancel to discard changes.
Note: After creating or editing a filter, or number of filters, select Apply Filters to apply the filters to your mail. This button is not available for five minutes after selection.
A file name filter extracts an attachment's file name using the email's MIME headers and applies a decision based on the file name filter settings.
After creating or editing a filter, or number of filters, select Apply Filters to apply the filters to your mail. This button is not available for five minutes after selection.
Creating a File Name Filter
- Go to Filtering > Attachments and select the File Name Filters tab.
- Select Create and the Create A Filename Pattern Filter window displays.
- Filename Pattern: Use the asterisk sign (*) to match zero or more characters; use the question mark sign (?) to match a single character. For instance, to filter all executable attachments that include the word sample, create a filter *sample*.exe.
- Inbound action: Select the action to take on inbound emails that match this filter:
- Allow: Allow the email.
- Block: Block the email.
Note: The domain or user policy determines if the message is quarantined. Go to Policies > Domain Policy or User Policies.
- Ignore: Take no action.
- Scan Archives: Select if you want this filter to match files contained within compressed archive files.
- Comments (optional): Enter optional comments about this file name filter.
- Select Create or save this extension filter or Cancel to discard changes.
Note: After creating or editing a filter, or number of filters, select Apply Filters to apply the filters to your mail. This button is not available for five minutes after selection.
File Type Filters
Email Protection scans each attachment to determine its file type. If the file type matches any of those listed in the table below, then an action is applied to the email based on the file type filter settings.
File type filtering helps detect file extensions being changed to bypass filtering. For example, an executable file (.exe) is blocked even if the file has a text file (.txt) extension.
Go to Filtering > Attachments and select the File Type Filters tab. Follow the steps below to create a file type filter.
After creating or editing a filter, or number of filters, select Apply Filters to apply the filters to your mail. This button is not available for five minutes after selection.
Creating a File Type Filter
- Go to Filtering > Attachments and select the File Type Filters tab.
- Select Create and the Create A File Type Filter window displays.
- File Type:
- Inbound action: Select the action to take on inbound emails that match this filter:
- Allow: Allow the email.
- Block: Block the email.
Note: The domain or user policy determines if the message is quarantined. Go to Policies > Domain Policy or User Policies.
- Ignore: Take no action.
- Scan Archives: Select if you want this filter to match files contained within compressed archive files.
- Comments (optional): Enter optional comments about this extension filter.
- Select Create or save this extension filter or Cancel to discard changes.
Note: After creating or editing a filter, or number of filters, select Apply Filters to apply the filters to your mail. This button is not available for five minutes after selection.
MIME Type Filters
After creating or editing a filter, or number of filters, select Apply Filters to apply the filters to your mail. This button is not available for five minutes after selection.
Creating a MIME Type Filter
- Go to Filtering > Attachments and select the Mime Type Filters tab.
- Select Create and the Create A Mime Type Filter window displays.
- Mime Type: Enter a Mime type. Mime Type is the file type that is reported in the MIME Content-Disposition and Content-Type headers. Both are recorded in their raw (encoded) form and rfc2047-decoded form, if applicable. It consists of a general type and a specific type indicator. For example image/png, video/avi or text/html.
- Inbound action: Select the action to take on inbound emails that match this filter:
- Allow: Allow the email.
- Block: Block the email.
Note: The domain or user policy determines if the message is quarantined. Go to Policies > Domain Policy or User Policies.
- Ignore: Take no action.
- Comments (optional): Enter optional comments about this extension filter.
- Select Create or save this extension filter or Cancel to discard changes.
Note: After creating or editing a filter, or number of filters, select Apply Filters to apply the filters to your mail. This button is not available for five minutes after selection.