Block Empty HTML Emails
Available Languages
Introduction
This document describes how to block empty HTML emails.
Background
The body of HTML emails normally contains the HTML tags which always match as false negative if you use the normal blocking method for the plain text emails. These were suggested earlier in this filter:
if (NOT only-body-contains(".", 1))
{
Action
}
Where if you look at the emails being sent as HTML, they has these known parts: <HTML>, <Body>, <div>, <p>.
And also including the attributes of the text such as font details, color, and size, which is included in the tag <styles>.
Configurations
Block this type of email using this filter:
if (NOT only-body-contains(".", 1) OR body-contains("<p>\\xa0</p>|<o:p>\\xa0</o:p>",1))
{
quarantine("Policy");
log-entry("$FilterName triggered \n");
}
Explanation
Conditions explanation:
1. NOT only-body-contains(".", 1) matching the normal empty plain text emails
2. <p>\\xa0</p>: matching open source mail clients
3. <o:p>\\xa0</o:p>: matching outlook empty HTML emails
Note: xa0 is a non-breaking space symbol (&
To block only empty HTML emails but not plain text emails, use this:
if ( header("Content-Type") )
{
#to catch outlook emails
if (NOT only-body-contains(".", 1) OR body-contains("<p>\\xa0</p>|<o:p>\\xa0</o:p>",1))
{
quarantine("Policy");
log-entry("$FilterName triggered \n");
}
}
Revision History
| Revision | Publish Date | Comments |
|---|---|---|
1.0 |
08-Jul-2026
|
Initial Release |
FeedbackContact Cisco
- Open a Support Case
- (Requires a Cisco Service Contract)