Images in your Approved Images or Blocked Images lists are not triggering in Symantec Email Security.cloud.

The Approved Images and Blocked Images lists use a file's MD5 hash value. Therefore, the lists only matches against image files that are identical to those you previously submitted. Any change to an image file results in a different MD5 hash value, which prevents Symantec.cloud from identifying it.

To obtain an image from an email without modifying its hash value, save the email as HTML. This extracts its contents, including images, which you can upload to the Approved Images or Blocked Images list.

Comparing MD5 hash values

You may need to compare the MD5 hash value of an image present in the Approved Images or Blocked Images lists against the MD5 hash value of another image (either found through Email Track and Trace, or extracted from an email).

To find the MD5 hash value in the Symantec.cloud console

1.  Log in to the Symantec.cloud console.
2.  Navigate to Services > Image Control.
3.  Click either the Approved Images or Blocked Images tab.
4.  In the Description column, click the name of the image you are looking for.
5.  The MD5 hash is located in the URL of the new window, at the end, after the text Signature=. For example:
   
   https://clients.messagelabs.com/...&Signature=3c995e4d5b01d53921b2ea96a03597a6

To find the MD5 hash value using Email Track and Trace

1. In Email Track and Trace, search for the email that contains the image.
2. Click the email for details.
3. Navigate to the Attachments tab.

To find the MD5 hash using Microsoft File Checksum Integrity Verifier (FCIV)

See How to compute the MD5 or SHA-1 cryptographic hash values for a file on Microsoft.com.