Logout

Alt-N Discussion Groups > MDaemon Discussion Groups > MDaemon Content Filter > Filter on attachment with CONTENT-TYPE text/html

 [F] Alt-N Discussion Groups  / MDaemon Discussion Groups  / MDaemon Content Filter  /

Filter on attachment with CONTENT-TYPE text/html

[Berends, Pim]
Pim Berends
Newbie
Newbie
Posts: 5

MDaemon
RelayFax
Outlook Connector
SecurityPlus
WebAdmin
Pim Berends - 04:22am, Apr 12 2017

Sometimes I get phishing mails with an attached email message. This attached email contains a html phishing link. So I want to filter these attached emails to check them manually.

When I add a new rule with the following condition:
"If there's an attachment with CONTENT-TYPE of..." -) "text/html"

The result is that it flags all messages with or without an attachment.

Why does it pick all messages and not only the messages containing a html attachment?

  All MessagesOldest ItemsOlder ItemsNewer ItemsNewest Items

Jay Tolbert - Apr 12, 2017 3:26 pm (#1 Total: 2)  

 

Photo of Author
Jay Tolbert
Guru
Guru
Posts: 2813

MDaemon
RelayFax
SecurityPlus
WebAdmin
Probably because most messages are sent with "Content-Type:
multipart/alternative;". This means the message has multiple main
(text) parts. There is usually a "Content-Type: text/plain;" portion
for mail client's that don't support html and a "Content-Type:
text/html;" part which has the message with html formatting. MDaemon's
content filter is seeing this text/html part and matching the rule
condition. Open the source of a small message (usually a view source
menu option in your mail client). You'll see the multipart/alternative
content type in the message headers. Then after a boundary the separate
plain and html message parts. The mail client normally uses whichever
of these it is configured to read. The mail client doesn't show them as
attachments even though they are from how they are placed in the
message. Can't think of an easy workaround.

Jay Tolbert
Dickerson Engineering, Inc.

On 4/12/2017 4:22 AM, Pim Berends wrote:
> Sometimes I get phishing mails with an attached email message. This
> attached email contains a html phishing link. So I want to filter
> these attached emails to check them manually.
>
> When I add a new rule with the following condition:
> "If there's an attachment with CONTENT-TYPE of..." -) "text/html"
>
> The result is that it flags all messages with or without an attachment.
>
> Why does it pick all messages and not only the messages containing a
> html attachment?


Replies to this message
  • Pim Berends (May 15, 2017 7:07 am)


  • Pim Berends - May 15, 2017 7:07 am (#2 Total: 2)  

     

    Photo of Author
    Pim Berends
    Newbie
    Newbie
    Posts: 5

    MDaemon
    RelayFax
    Outlook Connector
    SecurityPlus
    WebAdmin
    Replying to: Jay Tolbert (Apr 12, 2017 3:26 pm)
    Probably because most messages are sent with "Content-Type: multipart/alternative;". This means the message has multiple main (text)...

    Hi Jay,

    I can follow your explanation. I will have to rely om my DNSBL, AV, spamfilter etc.

    Pim



      All MessagesOldest ItemsOlder ItemsNewer ItemsNewest Items



     Content:

    Read New | Search

     Guest:

    Email to Admin



    You are visiting as a Guest user.