Hi,
I had the same problem:
Using this url: webmail.mydomain.com I couldn't send the html messages. it keeps sending.
I checked the following log and found this error:
"[Wed Feb 12 10:45:20.860118 2020] [:error] [pid 11569:tid 140058212431616] [client 186.33.161.64:60455] [client 186.33.161.64] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:@.+=\\\\s*?\\\\(\\\\s*?select)|(?:\\\\d+\\\\s*?(x?or|div|like|between|and)\\\\s*?\\\\d+\\\\s*?[\\\\-+])|(?:\\\\/\\\\w+;?\\\\s+(?:having|and|x?or|div|like|between|and|select)\\\\W)|(?:\\\\d\\\\s+group\\\\s+by.+\\\\()|(?
![Sad :(](https://forum.centos-webpanel.com/Smileys/default/sad.gif)
?:;|#|--)\\\\s*?(?:drop|alter))|(?
![Sad :(](https://forum.centos-webpanel.com/Smileys/default/sad.gif)
?:;|#|--)\\\\s*?(?:update|i ..."at ARGS:_message. [file "/usr/local/apache/modsecurity-owasp-old/base_rules/modsecurity_crs_41_sql_injection_attacks.conf"] [line "211"]
[id "981248"] [msg "Detects chained SQL injection attempts 1/2"] [data "Matched Data: div id=\\x22 found within ARGS:_message: ..."
Note the rule id: 981248.
Option 1: via CLI
Add the following line in this file: SecRuleRemoveById 981248
/usr/local/apache/modsecurity-owasp-old/global_disabled_rules.conf
Note the rule id identified on previous step.
Restart apache service.
Option 2: via Dashboard:
Go to Security/Mod Security/Disabled Rules add add the following line:
SecRuleRemoveById 981248
Restart apache service.
Try sending html messages again.