I'm sorry. I didn't mean the MAILFROM test. I mean the MAILFROM entry that you put in the filter file, e.g. MAILFROM 50 CONTAINS suspect.
Filters work by looking at a specific piece of information, and comparing to information you supply. So the line "MAILFROM 50 CONTAINS suspect" does exactly that -- it checks to see if the MAILFROM (return address) contains "suspect". If so, the E-mail will trigger that test.
The Sender Blacklists check to see if the return address matches anything in a list you supply. It doesn't work the same way, as it looks for exact matches on E-mail addresses (so a line "[EMAIL PROTECTED]" won't match "[EMAIL PROTECTED]"), and partial matches on domains (so "@example.com" will match "[EMAIL PROTECTED]").
All I need to know is if the MAILFROM I describe above looks at the whole address in X-Declude-Sender, e.g. [EMAIL PROTECTED], or if it just looks at the stuff before the @ character or just looks after the @ character.
It looks at the entire address (which is the same one as in the X-Declude-Sender: header, and IMail SMTP log file MAIL FROM entries).
Also with the FROMFILE test if I put in an entry...
hotmail.com
would the FROMFILE test add points if the X-Declude Sender was [EMAIL PROTECTED]
Yes (and it would also catch E-mail from [EMAIL PROTECTED]).
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
