I have tried the following to match the string '</head>' in the body of an email:

if body :raw :contains "</head>" { if body :content "text/html" :contains "</head>" { if body :contains "</head>" {

All three result in

matching value ' with key </head>' => 0 finishing match with result: not matched

RFC 5173 says:

5.1. Body Transform ":raw"

The ":raw" transform matches against the entire undecoded body of a message as a single item.

Which seems like exactly what I want.

:content does not seem like what I want since it appears to only match the non HTML code content of the mime part.

Eventually what I want to do is to alert some of the code in the HTML portion the email. Failing that, to remove the HTML mime part entirely, but that is less desirable.

NB: I am not getting sieve.log errors the code seems to parse fine, it's just not matching how I expect.

-- I'm the High King of Fillory. I took a blood test.