Some emails have "SCANFAIL" header in the attachment

Technical Articles ID: KB95996
Last Modified: 2023-04-11 12:29:57 Etc/GMT

Environment

Data Loss Prevention Prevent (DLP) 11.6.x

Problem

The "SCANFAIL" header issue is observed by following the steps below:

Deploy DLP Prevent with the email protection rule.
Attach and Send a PDF (especially, Adobe Acrobat Reader) file in the email.

The Email is received with a "SCANFAIL header" in the Adobe PDF file.

Error in the log: mail server adds XRCIS action as SCANFAIL header and sent it through DLP and DLP mail log shows Allow through:

The engine test result shows:

Type: Format Plugin

Plugin name: McAfee Document plugin

Infections: [None]

Description: Corrupt content encountered. Cause of corruption: 'Document format corruption'

Actions: ESERVICES:ALLOWTHRU

Cause

Network Data Loss Protection (NDLP) isn't able to scan the content, as the content is access-protected.

Solution

The NDLP server sends back the original mail to the Mail Server with a modified "X-Header." Create a rule, based on the "X-Header" to manage the actions on the Mail Server.

Restrict the use of the specific type of PDF files in the organization.

Affected Products

Languages:

This article is available in the following languages:

Knowledge Center

Some emails have "SCANFAIL" header in the attachment

Environment

Problem

Cause

Solution

Affected Products

Languages:

Title

Title

Knowledge Center

Some emails have "SCANFAIL" header in the attachment

Environment

Problem

Cause

Solution

Affected Products

Languages:

Choose your region

Title

Title