> Source: [sk102494](https://support.checkpoint.com/results/sk/sk102494)

# sk102494 - Check Point gateway rejects malicious attachments in email instead of stripping attachment in MTA environment

| Property | Value |
|----------|-------|
| Solution ID | sk102494 |
| Date Created | 2014-09-29 |
| Last Modified | 2017-03-05 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- In an environment that has an external Mail Transfer Agent (MTA) server behind a Check Point gateway (that is also acting as an MTA), emails with malicious attachments are rejected by the gateway instead of being stripped by the Check Point MTA.

## Cause

When SMTP traffic passes through a Check Point gateway (i.e. the gateway is not the destination), an SMTP scan is performed on this traffic, and if a malicious file is encountered it is added to the gateway's cache. The next time the same file is passed through the gateway, it will be immediately blocked.

**This will cause the 3rd party MTA and the recipient not to receive the mail.**

**Note:** This will happen only when a 3rd party MTA is behind Check Point MTA and not with standalone Check Point MTA, topology example for the problematic scenario is shown in the following image:

![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk102494/root-cause.PNG)

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content