Hi; Just a side note... We have found that filtering on Headers is quite effective if it also has the blacklist.
At times spammers use a Hotmail or other free email accounts but they have their blacklisted address in the FROM that shows up in the HEADER. So what we have is not only a DELETE action on our blacklist but also a HEADER CONTAINS the blacklist as a weight of HOLD. It is amazing how many times this test stops a SPAM which would have not been caught otherwise. Regards, Kami -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Thursday, February 20, 2003 1:14 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Filtering on a header >When you are attempting to filter on a header for example this header > >X-Mailer: The Bat! (v1.52f) Business > >Would the following line in my filter file work >HEADERS 10 CONTAINS X-Mailer: The Bat! (v1.52f) Business > >Or should I use > >HEADERS 10 IS X-Mailer: The Bat! (v1.52f) Business > >Is their any real difference in efficiency between IS and CONTAINS in >the above example? Only the first one will work. The key here is that Declude JunkMail is looking at the *entire* headers (it isn't going through each one, line-by-line). So "IS" would only work if you had the entire headers in the filter. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
