Hi Scott,
Nothing like a quiet Sunday morning to get the questions going.
I have a filter question and will use the following header to explain. The
e-mail is being handled correctly by JunkMail according to the GLOBAL.CFG
settings
I would like to be able to filter on the domain names of mailservers in the
chain. In this case I would like to have an entry such as
WHATEVER CONTAINS .aebolts.com (Where WHATEVER is a valid filter screening
criteria for the mailservers in the chain). I know I can use HEADER for
this but is there a parameter I've missed that would let me have these
checked as JunkMail is parsing to do its thing on each of the hops. I have
HOPHIGH 6 in my GLOBAL.CFG.
I realize that this particular piece of SPAM has been identified as such by
many other tests, but that's not the question here.
As always, thanks for the time.
George Kulman
Partner
Ridge Systems, L.L.C.
Example Header follows:
***************************************************
Received: from mtiwmhc14.worldnet.att.net [204.127.131.114] by
mail.ridge-systems.com with ESMTP
(SMTPD32-7.13) id A1E0250252; Sun, 02 Feb 2003 09:57:36 -0500
Received: from mtiwmhc14.worldnet.att.net ([127.0.0.1])
by mtiwmhc14.worldnet.att.net
(InterMail vM.5.01.05.12 201-253-122-126-112-20020820) with ESMTP
id
<[EMAIL PROTECTED]
net>
for <[EMAIL PROTECTED]>; Sun, 2 Feb 2003 14:56:07 +0000
Received: from data.aebolts.com ([216.171.211.31])
by mtiwmhc14.worldnet.att.net (mtiwmhc14) with ESMTP
id <2003020214560611400kmvlje>; Sun, 2 Feb 2003 14:56:06 +0000
Received: from data.aebolts.com (data.aebolts.com [216.171.211.31] (may be
forged))
by data.aebolts.com (8.12.6/8.12.6) with ESMTP id h12FSook018111
for <[EMAIL PROTECTED]>; Sun, 2 Feb 2003 07:28:50 -0800
Received: (from root@localhost)
by data.aebolts.com (8.12.6/8.12.6/Submit) id h12FSo64018109;
Sun, 2 Feb 2003 07:28:50 -0800
Message-Id: <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
Reply-To: <[EMAIL PROTECTED]>
From: "Rick Wagner" <[EMAIL PROTECTED]>
Subject:
Date: Sun Feb 2 01:05:00 PST 2003
MIME-Version: 1.0
Content-Type: text/html;
Content-Transfer-Encoding: 7bit
X-RBL-Warning: SPAMCOP: Blocked - see
http://spamcop.net/bl.shtml?216.171.211.31
X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client
[8010000e].
X-Declude-Sender: [EMAIL PROTECTED] [127.0.0.1]
X-Declude-Spoolname: D31e0002502523542.SMD
X-Spam-Tests-Failed: 15 SPAMCOP, BADHEADERS, IPNOTINMX, WEIGHT10
X-Note: This E-mail was sent from (Private IP) ([127.0.0.1]).
X-Country-Chain: UNITED STATES->destination
X-ALLRECIPS: [EMAIL PROTECTED]
X-RCPT-TO: <[EMAIL PROTECTED]>
Status: U
X-UIDL: 341851603
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
