> I created this because I see quite a few messages that use an > IP for the HELO, (and often it is MY mail server's IP). I > have never, ever, not once seen such a message that wasn't > spam, so on my system that test will be weighted quite heavily.
No other MTA should connect to your MTA using your MTA's IP as HELO string. I don't know if there is any reason to connect with any other IP-address as HELO-string. Several people has set up a filter file containing HELO 0 CONTAINS [your.servers.ip.address] Now add this filter file to your global.cfg file and assign a very high weight. My EHLOFILTER catches 4% of all processed messages without any false positive (looking back the last 50 days) Most spam (~99%) failing this test has already reached a final weight > 200% of our hold weight. But anything going over 200% helps to decrease our operators review work. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
