WHM/cPanel .EML files triggering “This message has been rejected because it has a potentially executable attachment”

WHM/cPanel might trigger a bounce such as the following:

2023-03-14 20:11:01 1pc96v-0007q4-15 cancelled by system filter: This message has been rejected because it has\na potentially executable attachment "My trusted forward.eml"\nThis form of attachment has been used by\nrecent viruses or other malware.\nIf you meant to send this file then please\npackage it up as a zip
file and resend it.

Or you admin console at admin.google.com for Email Log Search might display:

Google tried to deliver your message, but it was rejected by the server for the recipient domain server.example.com by server.example.com. [a.b.c.d]. The error that the other server returned was: 550-Attached file 'Undelivered Mail Returned to Sender.eml' has disallowed 550 extension.

Point is probably .eml should be trusted, but if there is an exe in a .eml you could be harmed. But since you probably want to have less support you might be tempted to update this filter.

It’s entirely possible and has been discussed at the forums here.

The steps are to create a new Exim filter file, but first backup the existing Exim filter file.

Actual steps:

cp -p /etc/cpanel_exim_system_filter /etc/cpanel_system_filter_new

Search the  four file below for eml. You should find it on these lines: 50, 61, 78, 89

50: if $header_content-type: matches 
61: if $header_content-type: matches
78: if $message_body matches
89: if $message_body matches

Carefully remove eml and it’s pipe | . Be super careful.

Go into WHM and the Exim configuration manager. Search for system filter file

Choose the new file that you have just modified, and press Save.

Updating “System Filter File” from “/etc/cpanel_exim_system_filter” to “/etc/cpanel_system_filter_new”.
“System Filter File” was updated.

Now .eml attachments won’t be blocked.

References

Share this article

Leave a Reply

Your email address will not be published. Required fields are marked *