Cisco Cisco Email Security Appliance C170 Guia Do Utilizador
6-303
Cisco IronPort AsyncOS 7.3 for Email Advanced Configuration Guide
OL-23081-01
Chapter 6 Using Message Filters to Enforce Email Policies
Message Header Rules and Evaluation
Filters evaluate “processed” headers rather than the original message headers
when applying header rules. Thus:
when applying header rules. Thus:
•
If a header was added by a previous processing action, it can now be matched
by any subsequent header rule.
by any subsequent header rule.
•
If a header was stripped by a previous processing action, it can no longer be
matched by any subsequent header rule.
matched by any subsequent header rule.
•
If a header was modified by a previous processing action, any subsequent
header rule will evaluate the modified header and not the original message
header.
header rule will evaluate the modified header and not the original message
header.
This behavior is common to both message filters and content filters.
Message Bodies vs. Message Attachments
An email message is composed of multiple parts. Although RFCs define
everything that comes after a message’s headers as a multipart “message body,”
many users still conceptualize a message’s “body” and its “attachment”
differently. When you use any of the IronPort message filters named
everything that comes after a message’s headers as a multipart “message body,”
many users still conceptualize a message’s “body” and its “attachment”
differently. When you use any of the IronPort message filters named
body-
variable or
attachment-
variable, the Cisco IronPort appliance attempts to
distinguish the parts that most users consider to be the “body” and the
“attachment” in the same way that many MUAs attempt to render these parts
differently.
“attachment” in the same way that many MUAs attempt to render these parts
differently.
For the purposes of writing
body-
variable or
attachment-
variable message filter
rules, everything after the message headers is considered the message body, whose
content is considered the first text part of the MIME parts that are within the body.
Anything after the content, (that is, any additional MIME parts) is considered an
attachment. AsyncOS evaluates the different MIME parts of the message, and
identifies the parts of the file that is treated as an attachment.
content is considered the first text part of the MIME parts that are within the body.
Anything after the content, (that is, any additional MIME parts) is considered an
attachment. AsyncOS evaluates the different MIME parts of the message, and
identifies the parts of the file that is treated as an attachment.
shows a message in the Microsoft Outlook MUA where
the words “
Document attached below.
” appear as a plain text message body and
the document “
This is a Microsoft Word document.doc
” appears as an
attachment. Because many users conceptualize email this way (rather than as a
multipart message whose first part is plain text and whose second part is a binary
file), the Cisco IronPort uses the term “attachment” in message filters to create
rules to differentiate and act on the .doc file part (in essence, the second MIME
multipart message whose first part is plain text and whose second part is a binary
file), the Cisco IronPort uses the term “attachment” in message filters to create
rules to differentiate and act on the .doc file part (in essence, the second MIME