Google Workspace - GMail - Allow attachments

[Koldov]

We are getting a lot of mail ending up in quarantine and unfortunately it's from the LEA.

 

They appear to be Egress emails with the attachment .switch

 

I thought I'd sorted it adding the LEA domain to an allowed senders list in Google Workspace > Settings for Gmail > Spam, phishing and malware, but it didn't make any difference (as I guess it isn't being blocked as spam, phishing or malware).

 

I then looked at Compliance (content and attachment), but I can't really see any combination of settings that make it say 'email from LEA domain with a .switch attachment > send it to the inbox and not quarantine'...

 

I also found this in 'Safety' "Protect against encrypted attachments from untrusted senders" but I don't know where to add a 'trusted sender'?

[Primus]

We are getting a lot of mail ending up in quarantine and unfortunately it's from the LEA.

 

They appear to be Egress emails with the attachment .switch

 

I thought I'd sorted it adding the LEA domain to an allowed senders list in Google Workspace > Settings for Gmail > Spam, phishing and malware, but it didn't make any difference (as I guess it isn't being blocked as spam, phishing or malware).

 

I then looked at Compliance (content and attachment), but I can't really see any combination of settings that make it say 'email from LEA domain with a .switch attachment > send it to the inbox and not quarantine'...

 

I also found this in 'Safety' "Protect against encrypted attachments from untrusted senders" but I don't know where to add a 'trusted sender'?

 

What's the reason given for it being in quarantine?

 

I think you need to be really careful adding allowlist rules - you're effectively stripping away security and verification - best practice has been for a while not to add domains to allowlists etc.

[Koldov]

Well, helpfully the reason given is 'Attachments'

 

[b][i]Matched Rules

Rule description                         Quarantine name
                                             Attachments[/i][/b]

 

The email is from the LEA and the attachment is a .switch file.

 

What's the reason given for it being in quarantine?

 

I think you need to be really careful adding allowlist rules - you're effectively stripping away security and verification - best practice has been for a while not to add domains to allowlists etc.

 

I know, I only added the LEA domain into the allowlist as a test to see if it made a difference and it hasn't so it's already been taken out.

 

That's why I asked if there is a way to make the settings say 'an email from the LEA with a .switch attachment should not be quarantined.

Edited January 16, 2025 by Koldov

[Primus]

If you have a recent example you can get Google support to tell you more about why it's being quarantined by logging a ticket with them.

[Koldov]

Pretty sure it's because of the attachment.

 

We have all the 'recommended' settings in: Apps > Google Workspace > Settings for Gmail > Safety

 

Attachments

Applied at 'School'

Additional policies to protect against malware in emails. Learn more

 

View affected emails (charts access requires Google Workspace Enterprise Plus edition).

Protect against encrypted attachments from untrusted senders: ON

Protect against attachments with scripts from untrusted senders: ON

Protect against anomalous attachment types in emails: ON

Apply future recommended settings automatically.: ON

 

However, I've also just found this:

 

Protect against anomalous attachment types in emails

Uncommon and archaic file types are often used to spread malware. Apply this action to detect and protect against any email that contains an attachment that’s uncommon and very rare for your domain.

Choose an action

Choose a quarantine

Allowlist the following uncommon file types

 

So, I'm going to add switch there... I'd rather have another setting that says 'only from LEA' though...

[TronXP]

In the gmail settings under safety, there is an attachments settings, do you have rules setup in that part?

[Koldov]

Maybe I should have phrased the original post slightly differently (please forgive the fact that I'm obviously NOT a coder)...

 

10 print "[b][i]Do you use GMail controlled by Google Workspace?"[/i][/b] Wait for input YES/NO... Yes = GOTO 20, No = GOTO END 

20 print [b][i]"Do you receive .switch attachments on the notification email when your LEA sends an Egress message?"[/i][/b] Wait for input YES/NO... Yes = GOTO 30, No = GOTO END 

30 print [b][i]"Do these get caught in quarantine?"[/i][/b] Wait for input YES/NO... Yes = GOTO 40, No = GOTO 50

40 print [b][i]"How do you manage this?"[/i][/b] Wait for input MANUALLY RELEASE/SETTING or RULES... Manually release = GOTO END, Settings or Rules = GOTO 50

50 print [b][i]"What settings or rules have allowed you to achieve this? Please type your answer in the Post Quick Reply box below, thank you!"[/i][/b]

END
EXIT