> Source: [sk166293](https://support.checkpoint.com/results/sk/sk166293)

# sk166293 - Emails that contain malicious links are received encoded in Base64

| Property | Value |
|----------|-------|
| Solution ID | sk166293 |
| Date Created | 2020-04-13 |
| Last Modified | 2022-11-14 |
| Technical Level | General |
| Products | Email Security |
| Versions | Cloud |
| OS | Gaia |

## Symptoms

- * Emails that contain malicious links are received encoded in Base64.
* Disabling the "MTA Click-Time URL Protection (Link Re-Writing)" feature resolves the issue.

## Cause

In general, in MTA mode, a PostFix server receives and handles the emails. Emails are forwarded to the *in.emaild.mta* daemon, which parses the emails (as in our case, Base64 decode) and passes them to the TED process if needed (based on the configuration of the supported file types).  

In this case, the MTA failed to parse the email correctly. Therefore, when the MTA replaced/modified the email body, the MIME headers of that email body were not consistent with the content of the body just modified. As a result, Base64 content is received.

<br />

## Solution

This problem was fixed. The fix is included in:

* **[Mail Transfer Agent R80.20 Take 59](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk123174)**

Check Point recommends to always upgrade to [the most recent version](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=overview&product=430).  

For more details, contact [Check Point Support](https://www.checkpoint.com/support-services/contact-support/).

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content