How do I block messages where the Subject: field is missing or blank?

This article applies to:

• Trustwave MailMarshal (SEG)

Question:

• How do I block messages where the Subject: field is missing or blank?
• How do I block emails with a blank subject line?
• How do I block messages with no subject?

Procedure:

Quite often, you may receive spam where the Subject: field in the message header is either missing entirely, or is present but blank. Given that most legitimate email will include a correctly formatted Subject: field, you may want to completely block messages with no subject. This article outlines one method of blocking these messages. The rule described will block messages if either of the following is true:

• The Subject: field is completely missing from the message header.
• The Subject: field exists in the message header, but the subject is blank.

To block messages with no subject:

Some versions of SEG include a default rule Block if 'Subject:' Field Missing or Blank.

If this default rule is not present in your installation, use the following steps.

1. Download the zip file BlankSubject.zip from the Article Attachments section below.
2. Extract the BlankSubject.xml file into your {Install}\Config folder.
   • Note: If a file with this name already exists you can use the existing file.
3. Create the following rule in the MailMarshal Configurator or Management Interface:
   
   

   When a message arrives
Where the message is incoming
Where the message is categorized as 'Blank Subject'
Move the message to 'Suspicious Header'

4. When the rule is created, select the Commit configuration changes option.

Notes:

For information on blocking email where the From: field is missing or blank, see the following Trustwave Knowledgebase article:

• Q10233 - "How do I block messages where the header From: field is missing or blank?"

 

This article was previously published as:

NETIQKB40314