Case of the missing attachment?

[pic...@googlemail.com]

Please see the following log extract:

This is a full conversation between our spam blocker and our Argosoft mail server running 1.3.4.0.Note that the message size is quoted as 219163 in the MAIL FROM: and that the log reports Received 219161 bytes.

However, when it comes to saving it, the message has miraculously shrunk:

Message accepted for delivery (6540 bytes....

So what happened to the attachment?

We have Anti-virus, attachment filtering and text filtering all disabled, and there is nothing in the logs, or the headers, to suggest why the attachment disappeared.

Help?

[SMTP 049903 12-07-21 14:21:19] EHLO spamtitan@email
[SMTP 049903 12-07-21 14:21:19] 250-Welcome 18.130.xxx.xxx, nice to meet you...
[SMTP 049903 12-07-21 14:21:19] 250-AUTH=PLAIN LOGIN
[SMTP 049903 12-07-21 14:21:19] 250-AUTH PLAIN LOGIN
[SMTP 049903 12-07-21 14:21:19] 250-SIZE 20971520
[SMTP 049903 12-07-21 14:21:19] 250-8BITMIME
[SMTP 049903 12-07-21 14:21:19] 250-DSN
[SMTP 049903 12-07-21 14:21:19] 250-ETRN
[SMTP 049903 12-07-21 14:21:19] 250 HELP
[SMTP 049903 12-07-21 14:21:19] MAIL FROM:<som...@gmail.com> SIZE=219163 BODY=7BIT
[SMTP 049903 12-07-21 14:21:19] 250 Sender "som...@gmail.com" OK...
[SMTP 049903 12-07-21 14:21:19] RCPT TO:<som...@thingy.blah> ORCPT=rfc822;som...@thingy.blah
[SMTP 049903 12-07-21 14:21:19] 250 Local recipient "som...@thingy.blah" OK...
[SMTP 049903 12-07-21 14:21:19] DATA
[SMTP 049903 12-07-21 14:21:19] DNSBL checking with bl.spamcop.net
[SMTP 049903 12-07-21 14:21:19] Not in bl.spamcop.net
[SMTP 049903 12-07-21 14:21:19] Performing country lookup for peer 18.130.xxx.xxx
[SMTP 049903 12-07-21 14:21:19] API key is not specified. Country lookup will be not performed.
[SMTP 049903 12-07-21 14:21:19] 354 Enter mail, end with "." on a line by itself
[SMTP 049903 12-07-21 14:21:19] Received 219161 bytes
[SMTP 049903 12-07-21 14:21:19] Trusted connection or checking RECEIVED headers with DNSBL is disabled
[SMTP 049903 12-07-21 14:21:19] 250 Message accepted for delivery (6540 bytes, ID=<CAONoQcVszH5UUDZ1K6PHFi6=Q8n8yowXd3Uip...@mail.gmail.com>)
[SMTP 049903 12-07-21 14:21:19] QUIT
[SMTP 049903 12-07-21 14:21:19] 221 Goodbye
[SMTP 049903 12-07-21 14:21:19] SMTP connection 049903 on 100.64.xxx.xxx:25 with 18.130.xxx.xxx:51368 ended
[SMTP 049903 12-07-21 14:21:19] Number of current SMTP connections: 0

Would appreciate any thoughts.

Al

[pic...@googlemail.com]

So this gets weirder.

This is the same email, sent to two different recipients on the same server. The first one retains its attachment, but the second one loses it.

[SMTP 050089 12-07-21 15:55:26] Received SMTP connection on 100.64.129.17:25 from 18.130.xxx.xxx:48868
[SMTP 050089 12-07-21 15:55:26] Number of current SMTP connections: 1
[SMTP 050089 12-07-21 15:55:26] 220 mail.tracmail.net ArGoSoft Mail Server SMTP Module v.1.3.4.0 at Mon, 12 Jul 2021 14:55:26 GMT
[SMTP 050089 12-07-21 15:55:26] EHLO spam.filter
[SMTP 050089 12-07-21 15:55:26] 250-Welcome 18.130.xxx.xxx, nice to meet you...
[SMTP 050089 12-07-21 15:55:26] 250-AUTH=PLAIN LOGIN
[SMTP 050089 12-07-21 15:55:26] 250-AUTH PLAIN LOGIN
[SMTP 050089 12-07-21 15:55:26] 250-SIZE 20971520
[SMTP 050089 12-07-21 15:55:26] 250-8BITMIME
[SMTP 050089 12-07-21 15:55:26] 250-DSN
[SMTP 050089 12-07-21 15:55:26] 250-ETRN
[SMTP 050089 12-07-21 15:55:26] 250-STARTTLS
[SMTP 050089 12-07-21 15:55:26] 250 HELP
[SMTP 050089 12-07-21 15:55:26] STARTTLS
[SMTP 050089 12-07-21 15:55:26] 220 Go ahead
[SMTP 050089 12-07-21 15:55:26] Switching to secure channel. Using Tls12.
[SMTP 050089 12-07-21 15:55:26] EHLO spam.filter
[SMTP 050089 12-07-21 15:55:26] 250-Welcome 18.130.xxx.xxx, nice to meet you...
[SMTP 050089 12-07-21 15:55:26] 250-AUTH=PLAIN LOGIN
[SMTP 050089 12-07-21 15:55:26] 250-AUTH PLAIN LOGIN
[SMTP 050089 12-07-21 15:55:26] 250-SIZE 20971520
[SMTP 050089 12-07-21 15:55:26] 250-8BITMIME
[SMTP 050089 12-07-21 15:55:26] 250-DSN
[SMTP 050089 12-07-21 15:55:26] 250-ETRN
[SMTP 050089 12-07-21 15:55:26] 250 HELP
[SMTP 050089 12-07-21 15:55:26] MAIL FROM:<senderone@domain> SIZE=77942 BODY=7BIT
[SMTP 050089 12-07-21 15:55:26] 250 Sender "senderone@domain" OK...
[SMTP 050089 12-07-21 15:55:26] RCPT TO:<receiverone@domain> ORCPT=rfc822;senderone@domain
[SMTP 050089 12-07-21 15:55:26] 250 Local recipient "receiverone@domain" OK...
[SMTP 050089 12-07-21 15:55:26] DATA
[SMTP 050089 12-07-21 15:55:26] DNSBL checking with bl.spamcop.net
[SMTP 050089 12-07-21 15:55:26] Not in bl.spamcop.net
[SMTP 050089 12-07-21 15:55:26] Performing country lookup for peer 18.130.xxx.xxx
[SMTP 050089 12-07-21 15:55:26] API key is not specified. Country lookup will be not performed.
[SMTP 050089 12-07-21 15:55:26] 354 Enter mail, end with "." on a line by itself
[SMTP 050089 12-07-21 15:55:26] Received 77935 bytes
[SMTP 050089 12-07-21 15:55:26] Trusted connection or checking RECEIVED headers with DNSBL is disabled
[LDLV 050089 12-07-21 15:55:26] Putting to the mailbox for receiverone@domain, RecNo=1440
[LDLV 050089 12-07-21 15:55:26] Message has been successfully delivered to receiverone@domain
[SMTP 050089 12-07-21 15:55:26] 250 Message accepted for delivery (78337 bytes, ID=<679d575.19a2b.17a9...@btinternet.com>)
[SMTP 050089 12-07-21 15:55:26] QUIT
[SMTP 050089 12-07-21 15:55:26] 221 Goodbye
[SMTP 050090 12-07-21 15:55:26] Received SMTP connection on 100.64.129.17:25 from 18.130.xxx.xxx:48870
[SMTP 050090 12-07-21 15:55:26] Number of current SMTP connections: 2
[SMTP 050090 12-07-21 15:55:26] 220 mail.tracmail.net ArGoSoft Mail Server SMTP Module v.1.3.4.0 at Mon, 12 Jul 2021 14:55:26 GMT
[SMTP 050090 12-07-21 15:55:26] EHLO spam.filter
[SMTP 050090 12-07-21 15:55:26] 250-Welcome 18.130.xxx.xxx, nice to meet you...
[SMTP 050090 12-07-21 15:55:26] 250-AUTH=PLAIN LOGIN
[SMTP 050090 12-07-21 15:55:26] 250-AUTH PLAIN LOGIN
[SMTP 050090 12-07-21 15:55:26] 250-SIZE 20971520
[SMTP 050090 12-07-21 15:55:26] 250-8BITMIME
[SMTP 050090 12-07-21 15:55:26] 250-DSN
[SMTP 050090 12-07-21 15:55:26] 250-ETRN
[SMTP 050090 12-07-21 15:55:26] 250-STARTTLS
[SMTP 050090 12-07-21 15:55:26] 250 HELP
[SMTP 050090 12-07-21 15:55:26] STARTTLS
[SMTP 050090 12-07-21 15:55:26] 220 Go ahead
[SMTP 050090 12-07-21 15:55:26] Switching to secure channel. Using Tls12.
[SMTP 050090 12-07-21 15:55:26] EHLO spam.filter
[SMTP 050090 12-07-21 15:55:26] 250-Welcome 18.130.xxx.xxx, nice to meet you...
[SMTP 050090 12-07-21 15:55:26] 250-AUTH=PLAIN LOGIN
[SMTP 050090 12-07-21 15:55:26] 250-AUTH PLAIN LOGIN
[SMTP 050090 12-07-21 15:55:26] 250-SIZE 20971520
[SMTP 050090 12-07-21 15:55:26] 250-8BITMIME
[SMTP 050090 12-07-21 15:55:26] 250-DSN
[SMTP 050090 12-07-21 15:55:26] 250-ETRN
[SMTP 050090 12-07-21 15:55:26] 250 HELP
[SMTP 050089 12-07-21 15:55:27] SMTP connection 050089 on 100.64.129.17:25 with 18.130.xxx.xxx:48868 ended
[SMTP 050089 12-07-21 15:55:27] Number of current SMTP connections: 1
[SMTP 050090 12-07-21 15:55:27] MAIL FROM:<sendertwo@domain> SIZE=77948 BODY=7BIT
[SMTP 050090 12-07-21 15:55:27] 250 Sender "sendertwo@domain" OK...
[SMTP 050090 12-07-21 15:55:27] RCPT TO:<receivertwo@domain> ORCPT=rfc822;sendertwo@domain
[SMTP 050090 12-07-21 15:55:27] 250 Local recipient "receivertwo@domain" OK...
[SMTP 050090 12-07-21 15:55:27] DATA
[SMTP 050090 12-07-21 15:55:27] DNSBL checking with bl.spamcop.net
[SMTP 050090 12-07-21 15:55:27] Not in bl.spamcop.net
[SMTP 050090 12-07-21 15:55:27] Performing country lookup for peer 18.130.xxx.xxx
[SMTP 050090 12-07-21 15:55:27] API key is not specified. Country lookup will be not performed.
[SMTP 050090 12-07-21 15:55:27] 354 Enter mail, end with "." on a line by itself
[SMTP 050090 12-07-21 15:55:27] Received 77941 bytes
[SMTP 050090 12-07-21 15:55:27] Trusted connection or checking RECEIVED headers with DNSBL is disabled
[LDLV 050090 12-07-21 15:55:27] Putting to the mailbox for receivertwo@domain, RecNo=1442
[LDLV 050090 12-07-21 15:55:27] Message has been successfully delivered to receivertwo@domain
[SMTP 050090 12-07-21 15:55:27] 250 Message accepted for delivery (30770 bytes, ID=<679d575.19a2b.17a9...@btinternet.com>)
[SMTP 050090 12-07-21 15:55:27] QUIT
[SMTP 050090 12-07-21 15:55:27] 221 Goodbye
[SMTP 050090 12-07-21 15:55:27] SMTP connection 050090 on 100.64.129.17:25 with 18.130.xxx.xxx:48870 ended
[SMTP 050090 12-07-21 15:55:27] Number of current SMTP connections: 0

Any idea what's going on here?

Al.