upgrade to the latest version (and SA latest version) and see if it's still a problem<br><br clear="all">-- <br>Martin Hepworth<br>Oxford, UK<br>
<br><br><div class="gmail_quote">On 29 March 2011 15:39, Achim J. Latz <span dir="ltr"><<a href="mailto:achim%2Bmailwatch@qustodium.net">achim+mailwatch@qustodium.net</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
In case I was not clear enough, I also use version 4.79.11 like the original poster (from the Debian repositories), and a sample message looks like this (including the 4 dashes at the end):<br>
<br>
<br>
Received: from <a href="http://o1.heroku.sendgrid.net" target="_blank">o1.heroku.sendgrid.net</a> (<a href="http://o1.heroku.sendgrid.net" target="_blank">o1.heroku.sendgrid.net</a> [67.228.50.54])<br>
by mail.domain.tld (Postfix) with SMTP id 64C31100B59<br>
for <recipient@domain.tld>; Tue, 29 Mar 2011 12:57:22 +0200 (CEST)<br>
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed; d=<a href="http://sendgrid.info" target="_blank">sendgrid.info</a>; h=date:from<br>
:to:message-id:subject:mime-version:content-type<br>
:content-transfer-encoding:sender; s=smtpapi; bh=cjVxj8SvXqfJ+OD<br>
0qUgOCS/ZHMk=; b=lMMNyUB/AD8iwYNLB7J1466jdpZt9PD8aE1G270rqblp5OE<br>
Z+nnMvIxDP7bXPZ51k6ur8Qcot8Fg6YsQbsYKtQh4+dO3ncoZWrQr8y/YmiPUoKI<br>
KLajypfLIBHzF3FvKlb1WvtPI1/Xg27c/njC9BkYj/bxlBuYXdrEVMMVSBqo=<br>
DomainKey-Signature: a=rsa-sha1; c=nofws; d=<a href="http://sendgrid.info" target="_blank">sendgrid.info</a>; h=date:from<br>
:to:message-id:subject:mime-version:content-type<br>
:content-transfer-encoding:sender; q=dns; s=smtpapi; b=tt7Xxp5bx<br>
+hVEMhzOMZTtnD+loZcvTHTqopuSZb14cr54FqU7bvWupRYJPqHzgn/ceiv35QBY<br>
ki90PTJnOecJaneKHTaTMYB3IgGS/Mj3AqSisxnjd2PP8/GasL5FRfH8cF/phPMQ<br>
SypEcAQWSAL5Ii2vcesHlWlx4U6mUvdiTA=<br>
Date: Tue, 29 Mar 2011 03:57:19 -0700<br>
From: recipient <<a href="mailto:no-reply@recipient.eu" target="_blank">no-reply@recipient.eu</a>><br>
To: recipient@domain.tld<br>
Message-ID: <4d91bb0f59202_75034194989558c@railgun64.53306.mail><br>
Subject: New inquiry from your website<br>
Mime-Version: 1.0<br>
Content-Type: multipart/alternative<br>
Content-Transfer-Encoding: 7bit<br>
X-Sendgrid-EID: fg9kZZpXkJUwMfpjPNokyRcJeLbgGU+lau0B86ToVheEbpM2VsYILCZyk/AwQFhbDumpBXedgS9rtQaAAdDd7yFRvdye8ScGSNRG5dePguMLKXugPBLSMvx6+tHMZxOm0YMP2Tp1jpPuopwwCEEn7w==<br>
Sender: recipient <no-reply=<a href="http://recipient.eu" target="_blank">recipient.eu</a>@<a href="http://sendgrid.info" target="_blank">sendgrid.info</a>><br>
<br>
This is a multi-part message in MIME format...<br>
----<div><div></div><div class="h5"><br>
<br>
<br>
On 29/03/2011 16:23, Achim J. Latz wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Good afternoon:<br>
<br>
Did this issue get resolved? I am seeing exactly the same issue today<br>
with emails that are generated by <a href="http://sendgrid.info" target="_blank">sendgrid.info</a>. I found a couple of<br>
support articles [1, 2], but they address MailScanners anti-phishing<br>
rather than the MIME parser.<br>
<br>
At the same time, I tried to disable all content checks (first via rules<br>
file, now completely like so):<br>
<br>
Dangerous Content Scanning = no<br>
<br>
and still the messages get scanned and ultimately bounced with "Could<br>
not analyze message".<br>
<br>
Is there a way to fix this, or at least turn the checks off? Is<br>
"Dangerous Content Scanning" perhaps the wrong setting for this behaviour?<br>
<br>
Thanks, Achim<br>
<br>
[1]<br>
<<a href="http://support.sendgrid.com/entries/360112-mailscanner-has-detected-a-possible-fraud-attempt" target="_blank">http://support.sendgrid.com/entries/360112-mailscanner-has-detected-a-possible-fraud-attempt</a>><br>
<br>
[2]<br>
<<a href="https://www.interspire.com/support/kb/questions/1104/Recipients+are+seeing+phrases+like+%22MailScanner+has+detected+a+possible+fraud+attempt+from...%22" target="_blank">https://www.interspire.com/support/kb/questions/1104/Recipients+are+seeing+phrases+like+%22MailScanner+has+detected+a+possible+fraud+attempt+from...%22</a>><br>
<br>
<br>
On 21/05/2010 15:55, Julian Field wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
You can get it if you have Raw Queue Files switched on, straight from<br>
the quarantine.<br>
<br>
On 21/05/2010 14:44, Gary Faith wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
I can get the message in the spam quarantine folder but how do I get<br>
the raw message? Do I need to shutdown MailScanner and only have<br>
sendmail running until after they say it was sent or is there some<br>
other way to get it?<br>
Gary<br>
<br>
>>> Julian Field <<a href="mailto:MailScanner@ecs.soton.ac.uk" target="_blank">MailScanner@ecs.soton.ac.uk</a>> 5/21/2010 5:33 AM >>><br>
Can you send me a URL of a sample message (raw queue files preferred) so<br>
that I can try this out for you please?<br>
<br>
Jules.<br>
<br>
On 19/05/2010 21:12, Gary Faith wrote:<br>
> I have some e-mail being sent by one individual to MailScanner<br>
running ver 4.79.11 and the messages are getting tagged as {Dangerous<br>
Content?}. I am running MailScanner with clamav& sanesecurity<br>
signatures, scamnailer, razor, pyzor& dcc. Mailwatch reports that it<br>
isn't a virus it is "Other Infection":<br>
><br>
> Anti-Virus/Dangerous Content Protection<br>
> Virus: N<br>
> Blocked File: N<br>
> Other Infection: Y<br>
> Report:MailScanner: Could not analyze message<br>
><br>
> The message has contains this:<br>
><br>
> Warning: This message has had one or more attachments removed<br>
> Warning: (the entire message).<br>
> Warning: Please read the "XXX-Attachment-Warning.txt" attachment(s)<br>
for more information.<br>
><br>
> This is a message from the MailScanner E-Mail Virus Protection Service<br>
> ----------------------------------------------------------------------<br>
> The original e-mail message contained potentially dangerous content,<br>
> which has been removed for your safety.<br>
><br>
> At Wed May 19 15:36:22 2010 the content filters said:<br>
> MailScanner: Could not analyze message<br>
><br>
> The sender uses Maximizer to generate the e-mail with a PDF<br>
attachment. I had the sender use Maximizer and send only the message<br>
without the attachment and it comes in fine. I had them send only the<br>
attachment via Outlook and it comes in fine. It seems the problem is<br>
with Mazimizer but I am not sure why.<br>
><br>
> I can send the quarantined message or whatever is needed to<br>
determine the problem off list.<br>
><br>
> I need help in tracking down where the problem is and getting it<br>
fixed.<br>
><br>
> Thanks,<br>
><br>
> Gary Faith<br>
</blockquote></blockquote>
<br>
<br>
</blockquote>
<br>
<br>
-- <br>
Achim J. Latz, Qustodium Internet Security<br>
<a href="mailto:achim.latz@qustodium.net" target="_blank">achim.latz@qustodium.net</a> · <a href="http://www.qustodium.net" target="_blank">http://www.qustodium.net</a><br>
Data Encryption · Backup Automatisation · E-Mail Protection<br>
-- <br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info" target="_blank">mailscanner@lists.mailscanner.info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/mailman/listinfo/mailscanner</a><br>
<br>
Before posting, read <a href="http://wiki.mailscanner.info/posting" target="_blank">http://wiki.mailscanner.info/posting</a><br>
<br>
Support MailScanner development - buy the book off the website! </div></div></blockquote></div><br>