Kami, Great idea!!! This is much better then using contains on the header (since header forging is easy).
Darrell ---------- Original Message ---------------------------------- From: "Kami Razvan" <[EMAIL PROTECTED]> Reply-To: [EMAIL PROTECTED] Date: Mon, 23 Jun 2003 18:15:06 -0400 >Hi; > >Do you know what the REVDNS is? We are finding good results for adding >negative weight to domains that are like this. We simply have a negative >REVDNS list. > >REVDNS -20 CONTAINS .yahoo.com >REVDNS -20 CONTAINS .aol.com > >The above are two entries in our list. > >Regards, >Kami > >-----Original Message----- >From: [EMAIL PROTECTED] >[mailto:[EMAIL PROTECTED] On Behalf Of Darrell LaRock >Sent: Monday, June 23, 2003 5:55 PM >To: [EMAIL PROTECTED] >Subject: [Declude.JunkMail] Kodak picture CD and Spam Domains > > >I have been seeing a lot of mail failing the spam domains test with kodak's >picture cd. It allows users to use their own email address when sending >pictures, but it comes from Kodak's servers. > >Is their any other way around this? Right now I setup a filter to subtract >the spam domains weight if picturecd.kodak.com is found in the headers. > >Also, not to mention their mail fails the BADHEADERS test for a bogus time >zone. > >Darrell > >> **COPY OF THE MESSAGES HEADERS - THESE ARE IMPORTANT FOR US TO SEE IF >> YOU FEEL THIS MESSAGE IS IN ERROR** >> Received: from picturecd2.kodak.com [192.232.121.246] by >mail1.gannett-tv.com with ESMTP >> (SMTPD32-7.15) id AE6BDC3601D6; Mon, 23 Jun 2003 00:13:31 -0400 >> Received: from picturecd.kodak.com >(dialup-67.31.149.71.Dial1.Denver1.Level3.net [67.31.149.71]) >> by picturecd2.kodak.com (8.11.6/8.11.6) with SMTP id h5N3gPU02484 >> for <[EMAIL PROTECTED]>; Sun, 22 Jun 2003 23:42:25 -0400 (EDT) >> Message-Id: <[EMAIL PROTECTED]> >> From: [EMAIL PROTECTED] >> To: [EMAIL PROTECTED] >> Subject: clouds 2nd try >> Date: 22 Jun 2003 21:42:44 Mountain Standard Time >> Content_Description: >> Content_Description: >> Content_Description: >> MIME-Version: 1.0 >> Content-Type: multipart/mixed; boundary=3_boundary > >--- >[This E-mail was scanned for viruses by Declude Virus >(http://www.declude.com)] > >--- >This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, >just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe >Declude.JunkMail". The archives can be found at >http://www.mail-archive.com. > >--- >[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > >--- >This E-mail came from the Declude.JunkMail mailing list. To >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >type "unsubscribe Declude.JunkMail". The archives can be found >at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
