[SOLVED] Block Mails with UTF-8 Subject

[Elompenta]

Hi together,

i see that much mails comes in with an encoded UTF-8 Header like this:

Proxmox Admin Notification:

Sender:   ehmefzb@jobinscenter.mom
Receiver: mail@domain.tld
Targets:  mail@domain.tld

Subject: =?utf-8?B?RWZmZWt0aXZlIEJlaGFuZGx1bmcgdm9uIEjDpG1vcnJob2lkZW4gaW4gamVkZW0gU3RhZGl1bQ==?=

Matching Rule: Monitor - Spam Level 1

.....

If i decode this mime header (https://dogmamix.com/MimeHeadersDecoder/) the subject will result in "Effektive Behandlung von Hämorrhoiden in jedem Stadium".
What i have to do to block this subject?

I have tried the following strings ins the policies:

=?utf-8?B?RWZmZWt0aXZlIEJlaGFuZGx1bmcgdm9uIEjDpG1vcnJob2lkZW4gaW4gamVkZW0gU3RhZGl1bQ==?=
=\?utf-8\?B\?RWZmZWt0aXZlIEJlaGFuZGx1bmcgdm9uIEjDpG1vcnJob2lkZW4gaW4gamVkZW0gU3RhZGl1bQ==\?=
--> regex escaping is correct:  https://regex101.com/r/2nqUEY/1
Effektive Behandlung von Hämorrhoiden in jedem Stadium

I don't found how I can block these subject with a rule.
Can you help me / explain to me how the subject will be compared / decoded before compare?

 

[dcsapak]

fields will be decoded before passing matching in the 'match field' object, so you could simply match on the decoded subject

 

[Elompenta]

so you could simply match on the decoded subject

okay, i have tested it already.
This will not work for incoming spam mail

I have listed the decoded string to a match pattern "subject=xyz"


Or do you see any problem with the German umlauts like "ä"?

Is there any known issue for this scenario or can I collect some debug data of the matching.
I have this rule, but incoming mails with the utf-8 encoded subject will be accepted.

Is there any way to enable a subject logging also in the mail.log / Tracking Center?

 

[dcsapak]

yes i think you'd have to replace the "umlaute" with '.*' to properly match it (the field will be decoded as utf8, but standard 'umlaute' are (sadly, this will change some time in the future) saved as iso-8859; so that won't match)

Is there any way to enable a subject logging also in the mail.log / Tracking Center?

no there is no subject logging, and i don't think it would help much in this case anyway