RE: Using Amavis to reject/quarantine email with MIME-encoded Subject Fields

-----Original Message-----
From: amavis-users [mailto:[email protected]] On Behalf Of Benny Pedersen
Sent: 31 August 2021 20:44
To: [email protected]
Subject: Re: Using Amavis to reject/quarantine email with MIME-encoded Subject Fields

On 2021-08-31 18:58, Benedict White wrote:

> header  MyRuleNumberOne          Subject =~ /RgNC10LTQ/i
> 
> score	MyRuleNumberOne		5.0
> 
> The rules looks for something containing " RgNC10LTQ" and the i after
> the / means case insensitive. You can remove that if this is the
> precise spelling you are looking for.

https://spamassassin.apache.org/full/3.1.x/doc/Mail_SpamAssassin_Plugin_WhiteListSubject.html

it supports blacklist :=)

it must be mime decoded content in the blacklist_subject ....


###
My understanding is that the subject appears in the header and isn't encoded. The reason it appears as this gobbledegook is an error in the spam generation, as such, the error can be exploited with a simple rule as I wrote.

Kind regards

Benedict White