I'd avoid the ANYWHERE filter if possible. Perhaps replace it with HEADERS if that's what you want.
The anywhere will include the body, and those short matches on the body seem to match on strange things in attachments and such a little too often for me. Also ANYWHERE will be pretty CPU intensive compared to HEADERS or MAILFROM. Scott Fisher Director of IT Farm Progress Companies >>> [EMAIL PROTECTED] 06/09/04 10:50AM >>> Markus, I want to avail HOLD actions as much as possible (that way there is less work for me :>) ALLRECIPS END NOTCONTAINS @domain.com MAILFROM 50 ENDSWITH .cz They way I understand a filter file is that is it applied and scored against every e-mail message that comes in. So for the other domains in the system I want to allow or not penalize .cz mail. That is why I thought I would use the first line to exit the filter unless it is specifically for the domain in question. Now with the MAILFROM it will get an email message what ends with .cz Or maybe I should use (Rick's suggestion) ANYWHERE 50 CONTAINS .cz MAILFROM 50 CONTAINS .cz with the ANYWHERE line containing a training space. I was wondering if the filter approach is the best approach or is there another way to do this? I am thinking something like a blacklist but I am not sure how that would work?? Goran Jovanovic The LAN Shoppe > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:Declude.JunkMail- > [EMAIL PROTECTED] On Behalf Of Markus Gufler > Sent: Wednesday, June 09, 2004 11:33 AM > To: [EMAIL PROTECTED] > Subject: RE: [Declude.JunkMail] Blacklist one Country for one Domain > > > > > Please blacklist anything that has a .cz in the > > address line > > COUNTRIES doesn't look at the "address line" as your customer asked for. > It will filter if any IP-Address the contained in the mail header is > assigned to the Czech republic. > > Why not use something like > > MAILFROM 50 ENDSWITH .cz > > > What about other customers that want mail from the Czech republic? > > I consider to create a separate filter file (FILTER-CUSTOMERNAME) > > In this filter file put > > MAILFROM 0 ENDSWITH .cz > > > Then create a .junkmail action file for this customer and set > > FILTER-CUSTOMERNAME HOLD > > > > Markus > > > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- > [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.