Adding [External] at the ESA from outside emails.

[hankej]

Good Morning, 

In an effort to help our users determine whether emails are from outside our company we have decided that we would like to at the tag [External] to the subject header of emails coming in from the outside.  We have 3 rules in place to determine whether to add the tag to the email.  They are:

1.)  If the Enveloper Sender is an in our Internal_Email Dictionary or if the Subject Header Contains \[External\], then pass the rest of the remaining filters.  (We don't want these emails tagged)

2.)  If the Remote IP/Hostname is .company.com, then pass the rest of the remaining filters.  (We don't want these emails tagged)

3.)  If the Envelope Sender does not contain students.ntc.edu and the subject does not equal 56fghhtrewgfge4, then Prepend to the Value of Existing Header (Subject) - [External]

This works well for the most part, but on occasion we are getting emails with the subject lines like this: 

=?utf-8?b?W0V4dGVybmFsXSBSZTogW0NJT10gV2hv4oCZcyBOZXh0Pw==?=

I'm not sure why this is happening and wondering if anyone here might know why this is occurring.

We are running a Cisco C600V, version 10.0.0-203.  

Thank you for any advice you might have.

Joe

[Libin Varghese]

This happens when the Subject header is encoded to include characters beyond the standard ASCII range. This is done because SMTP is limited to 7-bit characters. Any 'hi-bit' characters must be encoded to fit into this range.

Like SMTP, the mail_logs are also plain 7-bit ASCII text and cannot display the encoded characters. This is why you find the Subject in its original encoded format when you view the mail_logs.

However, the filter should still process the subject based on its original content ideally.

Regards,

Libin Varghese