First, it's my understanding that the SPAMDOMAINS functionality works as MAILFROM CONTAINS compared to REVDNS CONTAINS. I'm pretty sure that you can have multiple listings for either column also, so the filter looks for either no failures or no passes when considering whether or not the test was failed as a whole (Scott, please correct me if I'm wrong).
Secondly, MAILFROM isn't necessarily the From: line in the E-mail, it is the From address reported in HELO (aka, X-Declude-Sender), and almost all valid forging senders of this type (like eBay) should be giving their own domain in the From address reported in HELO, and therefore it shouldn't be a problem. This message list works just that way, however Web forms found on most Web sites will fail a SPAMDOMAINS test, but that should be within your control and therefore manageable.
Matt
Markus Gufler wrote:
As we know the SPAMDOMAIN test is very usefull but can create false FP's if the message is not send from the providers MTA.
For example if send from a web form having the user's address as mail from. But also if Ebay send's out a confirmation mail and the mail address of the selling user has a domain listed in our spamdomains file.
Question: Can it be usefull if we add to our spamdomains file something like
@gmx. .ebay.com aol.com .ebay.com t-online.de .ebay.com
I'm not more familiar how this entries will work.
domain1.com domain2.com
A message having a sender domain "domain1.com" must have a REVDNS entry ending with (or only containing?) "domain1.com" or "domain2.com"
We can have multiple entries for "domain1.com" or for "domain2.com" (as alias)?
Markus
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
