Attachment stripping

[Rising Flight]

Hi experts

I am using exchange hybrid environment.

An external user for example xyz@somedomain.com has sent an email to my office365 user myuser@mydomain.com, the email contains attachment for example the attachment is abc.pdf, when email is received at myuser@mydomain.com the attachment is stripped, there is an attachment by name  abc.pdf.txt when i open the txt file i can see the  message attachment is removed. I did check on the email gateway its 100percent clear that attachment is not stripped. the external user is geniune and also attachment and this is not first time this is user is sending mails. how do i trace this issue 

[#2]

Check the message trace logs, it will show you whether EOP/ATP acted on the attachment: https://support.office.com/en-us/article/message-trace-in-the-office-365-security-compliance-center-...

[#3]

Does it only affect that one user sending to your domain? What happens if he renamed the file extension to .docx for example or zip it? Will it strip it then?

[#4]

Also have a look at the message trace in the security and compliance center!

[#5]

Sorry @Vasil Michev !
Didn’t see your reply there :)

[#6]

From Security and Compliance, Content search when i search i can see that attachment is stripped.
i can see txt file abc.pdf.txt when i open it i can see the message attachment has been removed.
(on email gateway it is abc.pdf and when it reached user it is abc.pdf.txt)
is microsoft stripping this attachment.

[#7]

Check all your mail policy’s and see if you find something there! Are you the only reciever?