I have a problem I have been trying to solve. When a contains filter comairs abainst the body of the email where does that body begin? Does it begin at the mime segment or does it begin at actual content?
For example If I have something like this Received: from ns1.ssc-isp.net [12.9.25.242] by standardabrasives.com (SMTPD-8.22) id AC660568; Mon, 12 Dec 2005 12:24:06 -0800 Received: from I295e.i.pppool.de ([85.73.41.94]) by ns1.ssc-isp.net (SMSSMTP 4.1.9.35) with SMTP id M2005121212184516674 for <[EMAIL PROTECTED]>; Mon, 12 Dec 2005 12:18:46 -0800 Received: from [192.168.207.41] (port=4196 helo=parents) by I295e.i.pppool.de with esmtp id 7511378754121 for [EMAIL PROTECTED]; Mon, 12 Dec 2005 21:18:39 +0100 MIME-Version: 1.0 Content-Type: multipart/related; boundary="=_469e734c3adb39df03c2f293185d8c73" Message-Id: <[EMAIL PROTECTED]> Date: Mon, 12 Dec 2005 21:18:36 +0100 To: <[EMAIL PROTECTED]> From: Jayme Dominguez <[EMAIL PROTECTED]> Subject: News Alert --=_469e734c3adb39df03c2f293185d8c73 Content-Type: text/html; charset="ISO-8859-1" Content-Transfer-Encoding: quoted-printable <Table><tr><td>This is a spam</td></tr></table> Does the body scanning start at --= or does it start at <Table Kevin Bilbee Network Administrator Standard Abrasives, Inc. [EMAIL PROTECTED] (805) 520-5800 x7332 ____________________________________ Changing the way industry works. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude EVA www.declude.com] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.