>it seems like any email that has attachment is triggering the BASE64 >test. We have put a weight of 14 hoping the body of the eMail trigger >this but now attachments are triggering this as well. For example:
Note that the base64 test should apply only to text and/or HTML segments. >This eMail: >============ >X-RBL-Warning: HELOBOGUS: Domain has no MX/A records. >X-RBL-Warning: BASE64: An binary encoded text or HTML section was found in >this E-mail. >X-RBL-Warning: WORDFILTER: Message failed WORDFILTER test (217) >X-Declude-Sender: <mailto:[EMAIL PROTECTED]>[EMAIL PROTECTED] >[209.81.57.203] >X-Declude-Spoolname: D932e00a901761f57.SMD >X-Note: This E-mail was scanned by Declude >(<http://www.declude.com>www.declude.com) for SPAM & virus. >X-Note: This E-mail was sent from ([209.81.57.203]). >X-Spam-Tests-Failed: HELOBOGUS, BASE64, WORDFILTER, WEIGHT20, WEIGHT20S >X-Weight: 25 >============ > >had two attachments (JPG) and (HTML). The body of the email was not encoded. How do you know the body was not encoded? Did you look at an .mbx file? Note that the HTML attachment will count towards the base64 test, as HTML should never need to be binary encoded. >Any way we can make this distinction so we can only flag the body of the >eMail and not the attachments? It's important to realize that with MIME, there is no distinction between the body of the E-mail and attachments. With MIME, the E-mail is divided into 1 or more segments, each of which can be text, HTML, a binary file, etc. Some of those may be visible, while others aren't. With a typical Outlook E-mail with a .ZIP attachment, you would have 3 segments: a text segment with the body of the E-mail, an HTML segment with the body of the E-mail, and the .ZIP attachment. Only the HTML (or text, depending on the mail client) segment would be visible, while the .ZIP file would appear as an attachment. In this case, the text segment (or HTML) would not be visible or even linked to as an attachment. So MIME can get confusing quite easily. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
