1

Topic: Amavis BANNED issue

==== Required information ====
- iRedMail version (check /etc/iredmail-release): v0.9.6
- Linux/BSD distribution name and version: CentOS 7
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MySQL
- Web server (Apache or Nginx):Apache
- Manage mail accounts with iRedAdmin-Pro? v2.5.0
- Related log if you're reporting an issue: maillog
====

I'm getting frequently banned emails.  The extensions .dat and .emz are not in amavisd.conf  Any ideas?

amavis[14135]: (14135-17) Blocked BANNED (.dat,image001.emz) {NoBounceInternal}, ORIGINATING LOCAL [108.46.135.141]:64327 [108.46.135.141] <steve@aipb.org> -> <jweiss@computercompany.net>, Queue-ID: 06B968D613C7, Message-ID: <007101d2913e$e25f1e10$a71d5a30$@aipb.org>, mail_id: KxFeNGQycuF8, Hits: -, size: 388500, 760 ms

amavis[31741]: (31741-20) Blocked BANNED (.dat,image002.emz) {NoBounceInternal}, ORIGINATING LOCAL [207.5.164.224]:49403 [207.5.164.224] <anita@balmoralbch.com> -> <carolyn@balmoralbch.com>, Queue-ID: 4ACCA831A101, Message-ID: <002b01d29381$db1ef8b0$915cea10$@balmoralbch.com>, mail_id: VMiMCYEiHCrE, Hits: -, size: 126818, 483 ms

amavis[31688]: (31688-07) Blocked BANNED (.dat,image002.emz) {NoBounceInternal}, ORIGINATING LOCAL [207.5.164.224]:49403 [207.5.164.224] <anita@balmoralbch.com> -> <geoff@balmoralbch.com>, Queue-ID: 4ACCA831A101, Message-ID: <002b01d29381$db1ef8b0$915cea10$@balmoralbch.com>, mail_id: RB2h4LYxK5-6, Hits: -, size: 126818, 468 ms

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2

Re: Amavis BANNED issue

Did you get bounce or notification about this banned email? Do you have 'zip' blocked in Amavisd?

3

Re: Amavis BANNED issue

There was no bounce or notification back with any of these emails.  In one case, I had them resend it to my Gmail account and then forwarded the same message to my balmoralbch.com account on iredmail and it went right through.

I do have zip attachments blocked but nothing was zipped in these emails.

I know that at least two of these came from Microsoft's Outlook 365.  Could there be something different with that?  Such as the image001.emz?

4

Re: Amavis BANNED issue

I just ran through my maillog and many of my BANNED emails have this same format - and there are many of them with no response back to the sender.

amavis[31688]: (31688-07) Blocked BANNED (.dat,image002.emz) {NoBounceInternal}, ORIGINATING LOCAL...

only the message numbers and the image number (image00X.emz) changes.

5

Re: Amavis BANNED issue

Hi jack,
an emz file is a compressed (z = zipped) emf or wmf file (= enhanced metafile / windows metafile format). Probably wmf files are banned by amavis service of your server.

If you don't want to pass all wmf files you should quarantine banned mails. But if you want to release mails from sql quarantine with amavisd-release, you have to patch amavisd-release (in debian: in /usr/sbin/) or amavisd-new 
o r  you have to set:
$spam_quarantine_method = 'sql:';

And you should notify someone about banned mails:
$banned_admin = "root\@$mydomain"; # to notify an admin (root=postmaster) or another email address
$warnbannedrecip = 1;  # (defaults to false (undef)) - to notify recipients

If you want to inform email senders you have to use D_REJECT or D_BOUNCE as final desteny for banned mails:
$final_banned_destiny     = D_REJECT;

6

Re: Amavis BANNED issue

Please don't ban "zip" in Amavisd, then try again.

7

Re: Amavis BANNED issue

I can't emulate the problem locally - but having made the change to allow zip files, I haven't seen any issues today.  Thank you for all your help.  I'll let you know if things come up in the next few days.

--- Jack

8

Re: Amavis BANNED issue

Create a new topic if it happens again. smile