Hi,
It seems that this behavior is directly related to emails retrieved from MS365. A check of the attachment would delay its delivery by the Microsoft server; Zammad would not be able to process the attachment retrieval within the allotted time and would ignore it.
Does this seem plausible to you?
Is it possible to increase the processing time for email retrieval in Zammad to allow security mechanisms to operate at Microsoft?
While you technically can increase the wait in between fetches, it won’t wait for the mail to grow a specific age. Thus your desired solution is faulty if the mail comes in a second before the fetch starts.
You should consider holding back emails that are still being checked by your MTA before putting them into the mailbox. I believe there’s an option for that with Microsoft.
In my personal opinion the way Microsoft does this is shitty, as a message that is still undergoing security checks should never -ever- be available to an user at that moment. Changing the messages content temporarily (this is what they do in the end) without any indicator to the end user is a bad thing as well.
It is possible that you are using Microsoft Defender. In this case, it usually helps to change the policy for attachments from “Dynamic Delivery” to “Block”.
We find that the policies was set on: Dynamic Delivery Delivers messages immediately, but replaces attachments with placeholders until Safe Attachments scanning is complete.
We’ll try with this following option: Block Prevents messages with detected malware attachments from being delivered. Delivery of safe messages might be delayed due to Safe Attachments scanning.