Warning: unsupported encoding specifier in message text part

Symptom:

The following warning can be logged by EMF when a message with invalid MIME is encountered and either of the following configuration options are enabled under Set Up > Policies:

[] Mark message with invalid MIME structure as decomposition failures
[] Mark message text parts using unsupported character sets as decomposition failures

Event Type: Warning
ID: 6082
Description: Unsupported or missing character set or unsupported encoding specifier in message text part
Details: A text/plain part was found with no or an unsupported character set identifier. The part will be marked as having caused a decomposition error.

Detailed Information:

A limitation exists in EMF 5.6 and earlier / DAS 1.0.2 and earlier where the text part that caused the decomposition failure will not be scanned since the content type is unknown. This limitation has been exploited by spammers who will send a message using an invalid content-transfer-encoding, and then send the message as plain text. A recent example looks something like this:

----------------------------------------
From: jslU77Uk3pI@yahoo.com
Subject: Free Model Show ;p
Date: Mon, 22 Dec 2003 15:58:09 -0800
X-WSS-ID: 13F986182NC83576-01-01
Content-Type: text/plain
Content-Transfer-Encoding: text/plain
MIME-Version: 1.0

Have you Seen PARIS HILTON doing stuff? Watch the action!!!.. Watch it before
it gets taken off the site...yadda yadda yadda ... Click and Enjoy, Because Free is Better!!.
----------------------------------------

The exploit in this example is the header:

Content-Transfer-Encoding: text/plain

because text/plain is not a valid Content-Transfer-Encoding type. EMF will mark the message as having caused a decomposition error if the option to "Mark message with invalid MIME structure as decomposition failures" is enabled.

If this option is not enabled or a "decomposition policy" is not in place to quarantine messages that cause decomposition errors, the message will likely be passed to the recipient unless blocked by another non-content policy.

Future versions of EMF and DAS attempt to scan the content of these message as 7-bit, just in case the motive for using an invalid Content Encoding was malicious.

Resolution:

As a work around, the following policy can be implemented to block messages that attempt to exploit this limitation:

Create an EMF policy that reads something like:

=====================================
Catch messages where...
Content-Transfer-Encoding contains "text/plain"

Take the following actions...
Quarantine the message with the tag 'bad message'
=====================================

It's worth noting that EMF will not pass these messages to recipients by default. The options:

[] Mark message with invalid MIME structure as decomposition failures
and
[] Mark message text parts using unsupported character sets as decomposition failures

are enabled by default; and a default "decomposition errors" policy quarantines messages that could not be scanned. Many customers choose to relax these defaults because legitimate mail can often be blocked. Every organization needs to decide how to best handle messages that could not be scanned by EMF. For additional information see the related article Decompression and decomposition errors on the right.