[Rspamd-Users] symbol "MIME_BAD_ATTACHMENT" firing on PDF/A attachments?

[Daniel Lysfjord]

On 2026-02-04 18:44, Gerald Galster wrote:
>> Danjel Jungersen via Users <users at lists.rspamd.com>:
>> 
>> On 03-02-2026 16:11, Aban Dokht via Users wrote:
>>> Hello list,
>>> 
>>> I have the default symbol "MIME_BAD_ATTACHMENT" with score 4 enabled.
>>> When receiving PDF-Files, which are indeed PDF/A files, I get:
>>> 
>>> MIME_BAD_ATTACHMENT (4) [pdf:application/pdfa]
>>> 
>>> in the history.
>>> 
>>> Is this intended or a false positive?
>> 
>> I have no idea!
>> 
>> But pdf can contain macros, so opening a pdf if a potential risk.
>> 
>> So one could argue that it is a bad attachment...
> 
> According to https://www.rfc-editor.org/rfc/rfc8118.html the mime type
> for "PDF/A" ("PDF for Archival") is "application/pdf", not 
> "application/pdfa".
> 
> If this bothers you, have a look at 
> /etc/rspamd/modules.d/mime_types.conf
> extension_map (local.d/override.d) or see 
> https://docs.rspamd.com/modules/mime_types/.
> 
> Alternatively lower the score for MIME_BAD_ATTACHMENT.
> 
> 
>> PS: Once again I send a kind thought to Adobe for making this awful 
>> addition to the pdf years ago...
> 
> We will likely see more emails like these due to European Union 
> regulations
> for electronic invoicing - EN 16931 / XInvoice / ZUGFeRD and PDF/A.
> 
> https://ec.europa.eu/digital-building-blocks/sites/pages/viewpage.action?pageId=894304528
> 
> Best regards,
> Gerald

I just created a PDF/A-4 (PDF 2.0 base), sendt it to myself from outside 
my network. I did not get a trigger on MIME_BAD_ATTACHMENT (I have the 
score on that one set to 5).

Regards,
Daniel