> So if the MIME encoding line ended with "...hgh", it could be seen as > "...hgh ...", with a space there.
So does JunkMail make everything in the BODY into "one line" (for filtering purposes) with only one CFLR at the end of it?
Correct.
Are there exceptions to this?
Yes -- it will also appear in its raw format (in case people need to filter based on the raw format for some reason).
>From your manual you say "..."filtertype" can be "CONTAINS", "STARTSWITH", "ENDSWITH", or "IS"..." but only CONTAINS is going to be effective in the BODY since there is only 1 STARTSWITH and only 1 ENDSWITH? Do I understand this correctly?
Correct. STARTSWITH checks to see if something (whatever you are filtering on) starts with a specific word/phrase. There are some rare cases where STARTSWITH/ENDSWITH would be useful in body filtering, but normally those are only used with other search areas (such as the remote IP address or subject).
Each line in a filter only looks at one "thing" -- that could be the subject of the E-mail, the entire set of headers, the body, etc. The STARTSWITH/ENDSWITH/IS/etc. only apply to the whole "thing" (so "BODY 0 STARTSWITH Hello" would only work if the E-mail body started with "Hello", which would never happen if MIME was used (as there would be MIME headers within the body)).
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
