[Rspamd-Users] symbol "MIME_BAD_ATTACHMENT" firing on PDF/A attachments?

[Gerald Galster]

> Danjel Jungersen via Users <users at lists.rspamd.com>:
> 
> On 03-02-2026 16:11, Aban Dokht via Users wrote:
>> Hello list,
>> 
>> I have the default symbol "MIME_BAD_ATTACHMENT" with score 4 enabled.
>> When receiving PDF-Files, which are indeed PDF/A files, I get:
>> 
>> MIME_BAD_ATTACHMENT (4) [pdf:application/pdfa]
>> 
>> in the history.
>> 
>> Is this intended or a false positive?
> 
> I have no idea!
> 
> But pdf can contain macros, so opening a pdf if a potential risk.
> 
> So one could argue that it is a bad attachment...

According to https://www.rfc-editor.org/rfc/rfc8118.html the mime type
for "PDF/A" ("PDF for Archival") is "application/pdf", not "application/pdfa".

If this bothers you, have a look at /etc/rspamd/modules.d/mime_types.conf
extension_map (local.d/override.d) or see https://docs.rspamd.com/modules/mime_types/.

Alternatively lower the score for MIME_BAD_ATTACHMENT.


> PS: Once again I send a kind thought to Adobe for making this awful addition to the pdf years ago...

We will likely see more emails like these due to European Union regulations
for electronic invoicing - EN 16931 / XInvoice / ZUGFeRD and PDF/A.

https://ec.europa.eu/digital-building-blocks/sites/pages/viewpage.action?pageId=894304528

Best regards,
Gerald