Summary:
Attachment filtering (or stripping) based on file name or file type considers only those MIME parts that correspond to file attachments. However, attachment filtering (or stripping) based on MIME type considers all MIME parts in the message.

The examples below demonstrate these differences.

Detailed Information:
The MMS Content Manager allows you to match content of a message based on File name, MIME type, or File type (as identified by the INSO engine.) A policy that identifies File type or File name is usually straight forward as to it's behavior.

1. For all messages sent to this user
1. with an "All executables files" attachment
1. quarantine the message with no tags

The above policy detects all executable files within the MIME structure of a message. Also straight forward:

2. For all messages sent to this user
2. with an "application/x-msdownload" attachment
2. quarantine the message with no tags

In the above example, all of the MIME parts of the message are compared against application/x-msdownload. Note that the true file types of the attachments are not considered by this policy.

Where this can get tricky is in policies that trigger on all attachments with few exceptions. Such as:

3. For all messages sent to this user
3. with any attachment that is not "All Hypertext files; All Text files"
3. quarantine the message.

The above policy will quarantine all messages that contain attachments, with the exception of HTML and Text attachments. This is a common policy since many Email clients send standard Email as HTML.

The policy:

4. For all messages sent to this user
4. with any attachment that is not "text/plain; text/html"
4. quarantine the message.

Will quarantine any message that contains any MIME part other then text/plain or text/html. This is more extensive then expected because it applies to the entire message not just the attachments. Most Email will be quarantined by this policy because most messages contain a multipart/* MIME part. This can usually be accommodated by adding 2 more entries to your list: "multipart/*" and "message/*", however policy #3 is just as affective.

Status:
Confirmed

Original Author: DLANG
Original Submitter: DLANG
Keywords: tech tip MMS ID#25854