Every Attachment Is Now Checked Before It Leaves

Attachments are how most malware and phishing get into an inbox. They work best when they come from a sender people trust, and a transactional email service is that kind of sender. If one account here sends a bad file, mailbox providers don't only judge that account. They judge the servers it went out through, and every other customer's mail goes out through the same ones.

From this release on, euromail checks every attachment before a send is accepted.

What gets refused#

We read the file itself, not only its name. Renaming setup.exe to invoice.pdf doesn't get it through.

These are refused:

• Programs, installers and scripts, and disk images.
• Shortcut files.
• HTML and SVG files, which can carry code that runs when they are opened. An SVG picture inside a Word or PowerPoint file is fine.
• Office files with macros.
• Password-protected archives, and archive formats we can't open. If we can't see inside, we can't tell you it is safe.
• Files whose content doesn't match their name, like a program called .pdf.

Everything that passes these rules is also scanned for viruses with ClamAV.

What goes through as before#

The files people usually send with transactional mail pass unchanged: PDFs, images, regular Word, Excel and PowerPoint files, CSV exports, calendar invites and plain zip files. We open zips and attached emails and check each file inside them by the same rules, so a script tucked inside a zip is caught too.

What you see when a file is refused#

The send is refused right away and nothing is queued. The answer names the file and gives the reason, so you know what to fix without opening a support ticket.

Here is a send with a program that someone renamed to look like an invoice:

{
  "from": "[email protected]",
  "to": "[email protected]",
  "subject": "Your invoice",
  "html_body": "<p>Invoice attached.</p>",
  "attachments": [
    {
      "filename": "invoice.pdf",
      "content": "TVqQAAMAAAAEAAAA...base64...",
      "content_type": "application/pdf"
    }
  ]
}

And the answer, with status 422:

{
  "error": {
    "type": "attachment_refused",
    "code": "ATTACHMENT_REFUSED",
    "message": "Attachment 'invoice.pdf' refused: the file is a Windows executable, which is not accepted"
  }
}

If a request has more than one refused file, the answer lists all of them, so you can fix everything in one go.

One answer for every recipient#

A request to fifty recipients is handled as a whole. Either all fifty are accepted or none are. Nobody gets the email while somebody else's copy bounces back as refused, and when you fix the file and send again, nobody gets it twice.

If the virus scanner is down for a moment, you get a temporary error asking you to retry shortly. We never send an attachment we couldn't scan. Retry the same request and it goes through once scanning is back.

The full list of refused file types, and the limits on zip files, is in the sending emails guide.