I noticed the new INI file option "FilterBase64html" in the release notes for the current version, but scanned both the support forum and the current docs for instructions on how to use it.  May have missed it somewhere.

Is the INI file syntax simply:

 FilterBase64html=1

... or is there more to it than that?  Also, can you expand on exactly how these messages are handled (quarantined, blocked w/o quarantine, which response message is returned, etc.)?

Thanks, Jim

Dan,

Are there any significant differences between using this INI option and using the RegEx that you outlined in one of your earlier messages...

(content\-type:\x20text/html\r\ncontent-transfer\-encoding:\x20base64\r\n)

Are you using the INI option, the RegEx, or both in your efforts?

I agree with you completely about the need for this option, having seen a lot of recent (and not-so-recent) spam utilizing this technique.  It's an obvious ploy to avoid keyword filtering, nothing that a "legitimate" application would do.  Whatever method represents the most efficient and effective means of blocking this type of message, I'm all for it.

Thanks for your reply, and for your (many) contributions to this support forum.

Jim

Jim,

Additional info:

I have modified my keyword filter as follows:

(\b(content\-type:\x20text/(html|plain)\r\ncontent-transfer\-encoding:\x20base64\r\n))

Dan S.