Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

I want to write a small PHP emailing class to be able to send HTML emails. My problem is that in the receiving email an antivirus will insert a header which sometimes simply breaks the entire email.

Unfortunately I cannot find the logic after which this AV is guided because the header is broken under quite a few conditions, either after the 'MIME-Version: 1.0' or after 'Content...' or after the 'From' header.

Can anyone give some pointers on the rules these AV insert these headers?

share|improve this question
1  
How does the AV header break the email? Sounds like it's a problem with their AV, not with how you send it, unless you are adding some funky headers. – SteveS Jul 6 '12 at 21:37
Which AV program are you using? I wouldn't expect an Antivirus tool to modify e-mail headers. I would think it should just quarantine anything that contains infected files or suspicious content. – Mark Jul 6 '12 at 21:57
Hi everyone. thanks for the answers. this is just one such header I found: 'X-EsetId: 39BBAA23559E37316DFEF0' that gave me grief. In itself it would not be a problem but it also adds a new CRLF which then breaks the email headers. the same behavior I found when using MSEssentials or AVG, but not on a PC without AV. thanks, Denis – DenisR Jul 7 '12 at 14:21

2 Answers

up vote 1 down vote

How is it breaking the e-mail? Is your e-mail format that you are generating correct? It sounds like most likely something about the formatting of your e-mail is off but it is still able to be parsed until the AV does its thing. I'm not aware of any AV software that actually breaks e-mails in general. Perhaps I don't understand what you mean by broken though.

share|improve this answer
up vote 1 down vote

Anti-virus software should never break the email. It may add a header or append some text to the body, but that shouldn't (and usually doesn't) effect the rest of the email.

You mentioned that you use an HTML email. If you closed all HTML tags correctly, when an anti-virus product adds something like Scanned by [AV-Name], it should simply be displayed however the anti-virus company intended it to. If you didn't close all tags correctly, it may end up somewhere randomly on the page (though probably near the bottom with funky markup).

If the mail is messed up because of an added header, this is definitely a bug. Headers shouldn't be visible to the user, especially ones that are not standardised (those usually start with "X-"). You should try to reproduce the bug on another machine (perhaps a virtual machine), and then report it to the anti-virus company with the steps you used to reproduce.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.