This test works very differently than most of the other tests. The key to this test is that it is perfectly normal for an E-mail to fail this test (especially if it is coming from a large company). Lots of spam will fail this test, and lots of legitimate mail will too. However, if an E-mail *passes* this test, it is almost certainly either [1] Legitimate mail, or [2] Easily blocked spam.Please help me understand the syntax of: IPNOTINMX ipnotinmx x x 0 -4In our case we very often see this test failing together with Base 64 and Sniffer or Spamcop but because of the negative value the total weight gets reduced and the message goes through.
If an E-mail fails this test, it gets 0 added to its weight (which seems appropriate, since we don't want to penalize legitimate mail). However, if an E-mail passes this test, the negative weight is added. This helps reduce false positives, as lots of smaller companies that have clueless mailserver administrators that get everything else wrong will get this right.
-Scott
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
