Re: [Declude.JunkMail] DYNAMIC - 09/17/2003 - A new filter to detect IP'd reverse DNS entries IP'd reverse DNS entries

[Matthew Bramble]

I'm hoping that an anti-filter won't be necessary for this to work, but it might be beneficial if there are some harder to detect strings like the one you pointed out (if folks feel it is necessary). The entry for counterbalancing Road Runner Business customers would be as follows:     MAILFROM    -3    ENDSWITH    .biz.rr.com My own reverse DNS on RR Residential would fail ([sub-region]-###-###-###-###.[region].rr.com).  They seem pretty good about keeping the spaces separate.  My concern is more so if these IP's are being used to send spam that isn't from detected open proxies.  I'm going to text search my filters some more, but it's probably safe. BTW, EASYNET-DYNA picks me up at home (office), but SORBS-DUL doesn't probably because my IP seems to only change with their network being changed (i.e. not dynamic).  This is why I score SORBS-DUL at a 6 and EASYNET-DYNA at a 4, and keep both with the DYNAMIC filter.  Legit mail should also pass even if it fails all three filters because of negative weighting. Matt Joshua Levitsky wrote: On Sep 17, 2003, at 8:21 PM, Matthew Bramble wrote: I think that the following is a candidate for exclusion: rrcs-nys-###-###-###-###.biz.rr.com Matthew, In the case of Road Runner I would put "ENSWITH rr.com" in the DYNAMIC and in the AntiDYNAMIC I would put "ENDSWITH biz.rr.com" because basically Road Runner puts locations in front of the rr.com so unless you know them all it would be hard to list em out. Like nyc.rr.com is New York City. When it has a location at the front it is a consumer account AFAIK and business stuff is in the biz.rr.com space. Anyone see differently on Road Runner? -Josh