On 2006-10-24 at 01:54 -0700, Adam D wrote: > This is the basic script I have been trying to work: > > elsif anyof (header :contains "Content-Type" "gif") { > fileinto "system.2-mail.missed-spam"; > } Michael Menge has explained what to look at. I'll explain why your approach isn't working. Where an image is sent as an attachment, rather than as the only content of the email (and with many mail-clients, even then), the image is one part of a "multipart" message. The mail's top-level Content-Type: header will then contain "multipart/mixed"; each part then has its own set of MIME headers, including content-type. You might want to read RFC 2046, section 5. RFC 2046 is MIME Part 2, Media Types. Section 5 is "Composite Media Type Values". What you'll typically see is something vaguely like: From: .. To: .. Subject: foo MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="fred" Blurb for non-MIME mail-clients, ignored by all MIME clients --fred Content-Type: multipart/related; boundary="barney" --barney Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit The plain text. --barney Content-Type: text/html; charset=US-ASCII Content-Transfer-Encoding: 7bit <p>Some HTML here, with an <img src="cid:wilma-gif-2006102400001@mail.example.org">image inlined</img> </p> --barney-- --fred Content-Type: image/gif; name="wilma.gif" Content-Transfer-Encoding: base64 Content-Disposition: inline Content-ID: <wilma-gif-2006102400001@xxxxxxxxxxxxxxxx> base64/text+here== --fred-- Or the image might not be flowed inline by the HTML and left as an attachment which a client might choose to show after the text content. Regards, -Phil ---- Cyrus Home Page: http://cyrusimap.web.cmu.edu/ Cyrus Wiki/FAQ: http://cyrusimap.web.cmu.edu/twiki List Archives/Info: http://asg.web.cmu.edu/cyrus/mailing-list.html