Creating a rule for blocking e-mails with a specific character set

This discussion has a more recent version.
JaliJali Posts: 1,769 F-Secure Employee

This article describes how you can create a rule to block e-mails with a specific character set.

If you want to create an e-mail firewall rule to block e-mails with a specific character set, you just need to reference the appropriate character encoding.

For example, you wish to block e-mails that are in Russian and use the Cyrillic alphabet. The common character encodings for Cyrillic are Windows-1251 and KOI8-R. When you look in the original message header, you might see something like the following:

Content-Type: text/plain;

By creating an e-mail firewall rule that keys off the above header, you can block the e-mails. To do this, create a rule matching the e-mail header > Message Headers > Attribute > Content Type > Operator > Contains > Value: "koi8-r".

Note: Similar rules can be created for other character sets as well. For example, if you want to block all e-mail messages in simplified Chinese, a rule to block "gb2312" should be created.

Note: The rules described above will only block the messages that actually specify the character set in the Content-Type message headers. Some foreign character set e-mails will specify the character set in the MIME boundaries rather than the message headers. To catch these, you must create a rule to look for the character set anywhere in the message. This would also catch any e-mails that discuss the character set in the body of the e-mail.

Sign In or Register to comment.