Content Filter to block Blank Subject, Body and no Attachment.

[sdonovan123]

Hello,

Is it possibel to cretae a conten filter that can block messages with blank subject, blank body and has no attachment?  We are having an issue with a number of our users getting emails with blank subject and bodies from external sources.

Thanks!

Shawn

[Libin Varghese]

Hi Shawn,

From what I know content filters currently do not have a does not contain or NOT condition for body-contains.

You can try testing with the below message filter instead.

Blank: if (NOT(subject == ".")) AND (NOT(body-contains(".",1))) AND (NOT(attachment-filename == "."))
{
log-entry("Blank email");
quarantine("Policy");
}

The three conditions essentially look at the subject header, email body and attachment-filename for any content (".") and negate the verdict (NOT).

Do note that this is just a sample filter and may require further testing.

Also, an email may appear to have a blank body on the email client however may contain certain html or hidden characters which the email client cannot display. Hence further tests would be required to confirm if this filter matches your requriement based on emails you see in your network.

An alternative condition to body-contains would be body-size.

For example
(body-size < 200)

Regards,
Libin Varghese

[sdonovan123]

Thanks for the reply.  I would prefer to do this via content filters and not message filters if at all possible. 

If that an option?

Thanks!

[Libin Varghese]

Not directly, but possibly using 4 content filters.

Content filter 1

if message body contains == "." Action Skip remaining content filters

Content filter 2

if subject contains == "." Action Skip remaining content filters

Content filter 3

if attachment-filename contains == "." Action Skip remaining content filters

Content filter 4

No condition Action Quarantine.

Placed in the same order the filters should act as AND operator and negate the quarantine action if any content is found in the first three filters.

Would need to be tested though to ensure legitimate emails are not quarantined by these.

Regards,

Libin Varghese