This document describes on which specific parts of an email message filter attachment rules apply on the Cisco Email Security Appliance (ESA).
On which specific parts of an email message do filter attachment rules apply on the ESA?
For the purposes of writing body- or attachment- message filter rules, everything after the message headers is considered the message body, whose content is considered the first text part of the Multipurpose Internet Mail Extensions (MIME) parts that are within the body. Anything after the content (that is, any additional MIME parts) is considered an attachment.
Because the ESA makes this distinction between the body and the attachment in multipart messages, there are several cases that you should be aware of when using the body-variable or attachment-variable message filter rules in order to achieve the desired result:
- If you have a message with a single text part, that is, a message containing a header of Content-Type: text/plain or Content-Type: text/html, then the ESA will consider the entire message as the body. If the content type is anything different, the ESA considers it to be a single attachment.
- A single, non-text part is always considered an attachment. For example, a message consisting of only a .zip file is considered an attachment.
- If the message is a multipart message, and the first part is a multipart/alternative attachment, the entirety of the multipart/alternative attachment is considered the content of the message and every other part is an attachment.
- If the message is a multipart message, and the first part is not a multipart/alternative attachment, the first text/plain attachment, not including the preamble, will be considered the content of the message.