Server flagging email attachments as winmail.dat

keat63

Well-Known Member
Nov 20, 2014
1,384
107
43
cPanel Access Level
Root Administrator
I had users complaining that my internal firewall was stripping out file attachments from emails.
When I checked, these files were winmail.dat.

Looking in CSF Mailscanner to see what they actually were, and MailScanner was also reporting them as winmail.dat. ???

I restarted exim and mailscanner, and now new files are being reported correctly, as DOCX or XLXS. (the old ones still show in MailScanner as winmail.dat)

However, now that this is corrected, my internal firewall is blocking DOCX and XLXS with a Content type : application/vnd.openxmlformats-officedocument.wordprocessingml.document

I've absolutely no idea what just happened.
Why would my server flag these as winmail.dat, and then why would my internal firewall start stripping out xlxs and docx immediately after..
Two totally independant devices at different locations at the same time ?

Since writing, I added XLSX and DOCX to my internal firewall rules, to be virus scanned and these are passing through the firewall also.
These have never been an issue until around 10:30 this morning, so as you can imagine, I'm a tad confused as to what just happened.
 
Last edited:

cPanelMichael

Technical Support Community Manager
Staff member
Apr 11, 2011
47,911
2,233
363
cPanel Access Level
DataCenter Provider
Twitter
Hello @keat63,

Can you share the log output in /var/log/exim_mainlog for one of the affected messages? To do this, find the message ID in the email's header and then search for it using the following command:

Code:
exigrep $MSGID /var/log/exim_mainlog
Thank you.
 

keat63

Well-Known Member
Nov 20, 2014
1,384
107
43
cPanel Access Level
Root Administrator
It's been and gone now and I moved on to something else. :)

I suspect the issue was with Mailscanner initially.
Then possibly a rogue setting in my internal firewall which had been checked but unsaved.
A combination of my actions, trying to determine the cause, which coincidentally looked to be related.
 
Last edited:
  • Like
Reactions: cPanelMichael