5.1 ORF Online Help
Select your ORF version:

Table of Contents

Attachment Filtering

The attachment filtering in ORF allows you to filter specific attachment types. The related configuration options are available under BlacklistsAttachment Filtering in the navigation.

Enabling or Disabling the Attachment Filtering

You can enable or disable the use of the Attachment Filtering on the FilteringTests page in the navigation.

Attachment Filtering Settings

Click the Settings button to configure the Attachment Filtering.


Blacklisted attachments can be replaced by a warning message. Edit the warning message text here. Three custom fields are supported by the editor, select these from right-click menu of the text box. The custom fields are replaced by their actual value when an attachment is replaced by the warning text.


Set the SMTP response sent by ORF when an email is dropped due to an attachment filter hit. Click the SMTP Response button to edit the response. More about the SMTP responses is available in the SMTP Responses section of the help.

Using the Attachment Filtering

Adding, modifying and deleting attachment filters

Click the New button to add a new attachment filter to the list. To modify an existing attachment filter, click Modify or hit Enter. Attachment filters can be deleted using the Delete button or the Delete key.

Sorting the attachment filter list

Click the column header of any column by which you wish to sort the attachment filter list. To reverse sorting, click the column header again.

Exporting and importing the attachment filters

Right-click on the expression list and select "Import List..." or "Export List..." Alternatively, you can do this from the menu, select FileImportAttachment filter list or FileExportAttachment filter list.

Using the Attachment Filter Properties Dialog

Attachments can be filtered based on the attachment file name or the attachment MIME type or both (combined).

Attachment Name

Set the Filter by attachment name checkbox to filter by the attachment name. This can be combined with the content type filter on the MIME Content Type tab.

Select the filter type (can be a simple text file name / wildcard expression or a regular expression) and enter the desired file name or expression to the Attachment Name edit box.

MIME Content Type

Set the Filter by MIME content type checkbox to filter by the attachment's content type. This can be combined with the attachment file name filter on the Attachment Name tab.

Select the filter type (can be a simple text / wildcard expression or a regular expression) and enter the desired MIME type name (e.g., image/jpeg) or expression to the Content type/regular expression edit box.

Testing the Expressions

Test your expression using the Test attachment name and Test content type edit boxes. If the test box contents match with the mask, a green "Match" label appears on the right side of the test box.


Select the action to be performed when the attachment is blacklisted by the filter. You can choose to replace the attachment with a removal notice or to drop the entire email.


Add an optional comment to the filter expression. This comment is logged when the filter expression catches an attachment. Helpful when you have to know which expression caught the email. The comment also can be used in the warning message text.


Filtering points

The attachment filtering can be used at the On Arrival filtering point only. Before email arrival, the email contents are not available, so the attachment filtering cannot be performed at that point.

Filtering attachments by file name extensions

By using regular expressions, you can easily filter attachments by file name extensions.

Start the ORF Administration Tool, select BlacklistsAttachment filtering in the left navigation pane.
Click New and tick the Filter by attachment name checkbox.
Set the expression type to Regular expression (Perl-compatible) and enter the filtering expression. For example, to block ZIP attachments, simply add
This will block all attached files ending with ".zip". You can also specify more than one extensions by a single expression. If you wish to block ZIP, EXE, COM and VBS attachments, enter the following expression instead:
Finally, configure what should ORF do with the attachment (Filter Properties tab), optionally assign a comment to the filter and click OK.

UUENCODED Attachments

Filtering UUENCODED attachments are not supported. See the Limitations section for more information.

Scanning inside archive files

ORF cannot scan files inside archive files (i.e., if you block EXE files, ORF will allow them through if they are inside a ZIP files). See the Limitations section for more information.

Copyright © Vamsoft Kft. All rights reserved. Document ID adm-oa-attachmentfltr, version 1.