Cisco Cisco Email Security Appliance X1070 Troubleshooting Guide
ESA FAQ: On which specific parts of an email
message do filter attachment rules apply on the
ESA?
message do filter attachment rules apply on the
ESA?
Document ID: 117833
Contributed by Tomki Camp and Enrico Werner, Cisco TAC Engineers.
Jun 24, 2014
Jun 24, 2014
Contents
Introduction
On which specific parts of an email message do filter attachment rules apply on the ESA?
On which specific parts of an email message do filter attachment rules apply on the ESA?
Introduction
This document describes on which specific parts of an email message filter attachment rules apply on the
Cisco Email Security Appliance (ESA).
Cisco Email Security Appliance (ESA).
On which specific parts of an email message do filter
attachment rules apply on the ESA?
attachment rules apply on the ESA?
For the purposes of writing body− or attachment− message filter rules, everything after the message headers is
considered the message body, whose content is considered the first text part of the Multipurpose Internet Mail
Extensions (MIME) parts that are within the body. Anything after the content (that is, any additional MIME
parts) is considered an attachment.
considered the message body, whose content is considered the first text part of the Multipurpose Internet Mail
Extensions (MIME) parts that are within the body. Anything after the content (that is, any additional MIME
parts) is considered an attachment.
Because the ESA makes this distinction between the body and the attachment in multipart messages, there are
several cases that you should be aware of when using the body−variable or attachment−variable message filter
rules in order to achieve the desired result:
several cases that you should be aware of when using the body−variable or attachment−variable message filter
rules in order to achieve the desired result:
If you have a message with a single text part, that is, a message containing a header of
Content−Type: text/plain or Content−Type: text/html, then the ESA will consider the entire message
as the body. If the content type is anything different, the ESA considers it to be a single attachment.
1.
A single, non−text part is always considered an attachment. For example, a message consisting of
only a .zip file is considered an attachment.
only a .zip file is considered an attachment.
2.
If the message is a multipart message, and the first part is a multipart/alternative attachment, the
entirety of the multipart/alternative attachment is considered the content of the message and every
other part is an attachment.
entirety of the multipart/alternative attachment is considered the content of the message and every
other part is an attachment.
3.
If the message is a multipart message, and the first part is not a multipart/alternative attachment, the
first text/plain attachment, not including the preamble, will be considered the content of the message.
first text/plain attachment, not including the preamble, will be considered the content of the message.
4.
Updated: Jun 24, 2014
Document ID: 117833