I want to give some negative weight for the following mail headers
Received: from mx0.gmx.net [213.165.64.100] by mail.zcom.it
(SMTPD32-7.15) id A9F343600D8; Sun, 19 Oct 2003 18:21:07 +0200
Received: (qmail 2815 invoked by alias); 19 Oct 2003 16:21:07 -0000
Delivered-To: GMX delivery to [EMAIL PROTECTED]
Received: (qmail 2767 invoked by uid 65534); 19 Oct 2003 16:21:07 -0000
Received: from n17.grp.scd.yahoo.com (HELO n17.grp.scd.yahoo.com)
(66.218.66.72)
by mx0.gmx.net (mx035-rz3) with SMTP; 19 Oct 2003 18:21:07 +0200
X-eGroups-Return:
[EMAIL PROTECTED]
Received: from [66.218.67.200] by n17.grp.scd.yahoo.com with NNFMP; 19 Oct
2003 16:21:01 -0000
X-Sender: [EMAIL PROTECTED]
X-Apparently-To: [EMAIL PROTECTED]
Received: (qmail 7332 invoked from network); 19 Oct 2003 16:21:00 -0000
Received: from unknown (66.218.66.172)
by m8.grp.scd.yahoo.com with QMQP; 19 Oct 2003 16:21:00 -0000
Received: from unknown (HELO mxsf15.cluster1.charter.net) (209.225.28.215)
by mta4.grp.scd.yahoo.com with SMTP; 19 Oct 2003 16:21:00 -0000
Received: from tuscolahnjiiu5 (24.231.210.135.bay.mi.chartermi.net
[24.231.210.135] (may be forged))
by mxsf15.cluster1.charter.net (8.12.9/8.12.8) with ESMTP id
h9JGKnMp046823
for <[EMAIL PROTECTED]>; Sun, 19 Oct 2003 12:20:57 -0400
(EDT)
So I've added in my global.cfg
SFILTER filter C:\IMail\Declude\filter_special.txt x 0 0
The content of the file filter_special.txt is
#######################################################
REVDNS -5 ENDSWITH .grp.scd.yahoo.com
#######################################################
The filter was not triggered.
I asume because it was forwarded by a GMX-Mailserver and so the
grp.scd.yahoo.com is out of my HOPHIGH=1 settings.
Question:
What consequences can I expect if I increase the HOPHIGH-value to 3 of 4.
More false positives from Spam-Databases?
More successfull catches from Spam-Databases?
More false positives because I will catch often the first SMTP-sending host,
which usually is a lazy configured SMTP-client. (missing REVDNS,
DUL-Blacklists, ...)
Longer processing times because the number of NS-lookups are doubled or
trippled?
Thanks in advance
Markus
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
