On 2025-04-15 Jim Pazarena via Exim-users <exim-users@lists.exim.org> wrote: > A recent bout of incoming phishing has raised a question regarding UTF-8 > traffic.
> while the actual content of a Subject: line as seen in an MUA shows: > Subject: =?UTF-8?Q?Final_Notice=3A_Email_Deactivation_ ( etc etc ) Looks like rfc2047 encoded text ... > what is logged in the exim MTA server logs is: > T="Final Notice: Email Deactivation ( etc etc ) which makes we wonder which mail reader cannot decode this. > questions is: > if a person tries to capture and block this in a dot.forward filter, > do you use: if $h_subject contains "final notice" > or: if $h_subject contains "final_notice" The former for matching on $h_..., the latter for $rh_. Please the difference between $header_ and $rheader_ https://www.exim.org/exim-html-current/doc/html/spec_html/ch-string_expansions.html#vi169 and consider setting headers charset "UTF-8" in the filter file. cu Andreas -- ## subscription configuration (requires account): ## https://lists.exim.org/mailman3/postorius/lists/exim-users.lists.exim.org/ ## unsubscribe (doesn't require an account): ## exim-users-unsubscr...@lists.exim.org ## Exim details at http://www.exim.org/ ## Please use the Wiki with this list - http://wiki.exim.org/
