Event: 'Unpack for B000xxxxxx.00000xxx.mml caught exception <An error occurred in the following line < Encoding method > The error was <Unknown Content-Transfer-Encoding>>'

This article applies to:

• Trustwave MailMarshal (SEG)
  • Note changed behavior at version 7.2
• Trustwave ECM/MailMarshal Exchange
• MailMarshal Secure Email Server (SES)

Symptoms:

• Event: 'Unpack for B000xxxxxx.00000xxx.mml caught exception <An error occurred in the following line < Encoding method > The error was <Unknown Content-Transfer-Encoding>>'
• Email processing fails.
• Email is not delivered.
• Email delivery fails.

Causes:

Information:

The valid Content Transfer Encoding mechanisms are:

• 7bit
• 8bit
• binary
• quoted-printable
• base64
• ietf-token
• x-token

MailMarshal attempts to resolve unrecognized entries, such as: 7-bit, 7bits, 8-bit, and 8bits, or invalid variants such as a trailing semicolon. 

• In MailMarshal SEG version 7.2 and above additional invalid entries are recognized.
  
  • If the Content Transfer Encoding is blank, MailMarshal assumes 7 bit plain encoding
  • Trailing "s" and other characters are ignored
  • You can also force MailMarshal to assume 7 bit plain encoding for ALL unrecognized types. See the section Force 7 Bit below.

You can configure MailMarshal to accept other incorrectly identified Content Transfer Encoding mechanisms.

Warning: Use this procedure with caution and record your actions for future reference.

• Configuring MailMarshal to accept incorrect type entries can cause unexpected behaviors at other points in the email scanning process.
• In particular, all email accepted with invalid encoding type is treated as plain text. If the actual data is not plain text, it will not be properly unpacked.

To force MailMarshal to accept an invalid encoding type, use the following steps.

1. On the Array Manager, edit the Registry (10.X: use Advanced Settings in the Management Console)
2. Navigate to the SEG Engine key:
   • In version 8.X: HKEY_LOCAL_MACHINE\SOFTWARE\Trustwave\Secure Email Gateway\Default\Engine
   • 10.X: value names have the prefix Engine. (Engine dot).
   • For full details of the location for each product version, see article Q10832.
3. Create a multi-string (REG_MULTI_SZ) named MimeEncodingTypes.
4. Map the invalid  MIME encoding types. To identify the invalid MIME encoding types, open a message in the deadletter folder. The log section of the message identifies the invalid encoding type.

   The following entry in the log section of a message in the deadletter folder identifies plain as an invalid encoding type.

   1800 10:42:40.482 Event - Unpack for B000487105.00000001.mml caught exception <An error occurred in the following line <plain> The error was <Unknown Content-Transfer-Encoding>>

   To fix the problem, add the following to the MimeEncodingTypes:

   plain=1

   Depending on what you find in the log section of other messages, you might also need to add additional types, such as the following, to the MimeEncodingTypes:

   7bit;=1
8bit;=1
text/plain=1
8-bit;=1
7-bit;=1
ISO-8859-1=1
quoted-printable;=2
=1       (use this entry to ignore a value of <> or blank Content-Transfer-Encoding)

5. Commit configuration changes.
6. Restart the Engine service.
7. If necessary, reprocess the relevant messages from your Deadletter\Unpacking directory. The messages with Unknown Content-Transfer-Encoding errors should now be processed normally.

    

Force 7 Bit (version 7.2 and above)

1. In the Engine registry location (as described above), add a DWORD entry Force7BitOnUnknownContentTransferEncoding
2. Set the value to 1.

Use this option with extra caution, and ONLY if you actually encounter important messages that have an invalid encoding. Most messages with bad encoding are spam or malicious mail.

Notes:

• Warning: Using the Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Trustwave cannot guarantee that problems resulting from the incorrect use of Registry Editor can be resolved. Make sure that you back up your Registry prior to making any changes.
• Advanced users could experiment with the value after the = in each MimeEncodingTypes line, which specifies the content type that MailMarshal assumes for the specific invalid encoding string.
  • The following values are recognized:
    0 - unknown (delete)
    1 - plain
    2 - quoted-printable
    3 - base64
    4 - uuencoded
• This information is provided "as-is". To properly resolve issues with malformed messages, contact the email sender.

This article was previously published as:

NETIQKB36391