Unfortunately ....

Here's what I did: I deleted the previous g_block lines and pasted your 
mfilter.rul code into the file, did a tellmail reload and tried again; 
..zip attachments from a GMail account into both compuvar.com and another 
domain went straight in unhindered.

I'm trying to avoid having to write a g_block_skip line for every other 
domain on the server ...

On 12/9/2015 4:11 PM, surgemail-support wrote:
> Right, sorry I thought that abbreviation would work but it won't as it 
> ends up matching the from address as well so you are stuck with 
> listing all the domains for which you don't want this rule...
>
>    g_block_files "*.zip"
>    g_block_skip "HIDDEN@.domain.name.1"
>    g_block_skip "HIDDEN@.domain.name.2"
>    g_block_skip "HIDDEN@.domain.name.3"
>    g_block_skip "HIDDEN@.domain.name.4"
>
> Another method would be mfilter.rul I think it will work like this:
>
> if (isin(to,HIDDEN@var.com")) then
>     if (attached("*.zip")) then
>         reject "attached zip files not permitted"
>     end if
> end if
>
>
> ChrisP.
>
>
> On 10/12/2015 11:10 a.m., Peter Dyke wrote:
>>
>> I'm not sure that worked:
>>
>>
>>    g_block_files "*.zip"
>>    g_block_skip "*,!HIDDEN@var.com"
>>
>> msgs with .zip attachments still getting through to both the 
>> compuvar.com domain and other domains.
>>
>>
>> SurgeMail Version 6.9a-1, Built Mar  5 2015 15:58:58, Platform 
>> Linux_64 (Surgeweb Enabled)
>>
>>
>> On Wednesday 09/12/2015 at 1:16 pm, surgemail-support  wrote:
>>> I think as Jim suggested this might do the trick (minor change to 
>>> syntax)
>>>          G_BLOCK_SKIP "*,!HIDDEN@em.destination.domain"
>>>
>>> ChrisP.]
>>>
>>>
>>> On 10/12/2015 6:47 a.m., Peter Dyke wrote:
>>>>
>>>> The administrator of one (and only one) of the domains on our SM 
>>>> has  requested that .zip attachments be blocked. [After they got 
>>>> hit with a  crypto-locker infection].
>>>>
>>>> g_archive_files would not work in this scenario
>>>> g_block_files would be fine but other domains on the server do not  
>>>> want such blocking
>>>> g_rename_files is also not per domain, and would not really be a 
>>>> block  anyway
>>>>
>>>> Anyone doing this, any suggestions, or am I missing something obvious?
>>>>
>>>>
>>>
>>>
>>
>>
>>
>>
>
>
>