How about some thoughts on selectively running tests, based on the HOP count?
Specifically, one of my strong reasons to buy Declude+IMail (yes, that's the way I view it!) for my gateway was because of the HOPHIGH feature for running ip4r tests against more than just the IP of the host that sent the message. The drawback is that some of those ip4r are only relevant for certain hops. Here's an example that leads to false positives in my setup, which in turn leads to me diluting the effectiveness of some tests by lowering their weight. NJABLDUL and SORBS-DUL list blocks from lots of ISPs, and are great to use if you are only testing the IP of the host that sent the message, but they are a false positive when an innocent workstation on that netblock sends a message through their own ISPs mailhost. I suppose one suggestion is that I could follow Kami's lead and put the ip4r tests that are direct-spam related in IMail, and have Declude test the header for those. Then have Declude set to HOP 1 instead of HOP 0 in my global.cfg ... Hmmm... that might close more doors than it opens. Some tests would have to be run in both places, like FIVETENMULTI and SORBS-ZOMBIE to be effective. So, any thoughts, comments, flames? Andrew 8) --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
