Hi;
 
I have added a couple of filters that work quite well using SPF.  Although by itself it does not do much but as a combination it is working for us.
 
Towards the end of the filters I have a couple of combo filters that I called [Elevate.?] where ? is the category of elevate weight.
 
The [Elevate.SPF.Fail] is as follows:
 
SKIPIFWEIGHT    50
TESTSFAILED END     NOTCONTAINS     [SPF.FAIL]
TESTSFAILED END     NOTCONTAINS    [COMBO.LINK]
 
TESTSFAILED 0 CONTAINS [NOLEGITCONTENT]
TESTSFAILED 0 CONTAINS [HEUR
TESTSFAILED 0 CONTAINS [REVDNS]
 
- the Combo.Link filter is a set of filters that detects if the email has any image or URL links in the body.
 
Here is the [COMBO.LINK] filter:
 
SKIPIFWEIGHT     50
 
TESTSFAILED   0   CONTAINS   [LINK.BODY]
TESTSFAILED   0   CONTAINS   [LINK.BODY.IP]
TESTSFAILED   0   CONTAINS   [EMAIL PROTECTED]
TESTSFAILED   0   CONTAINS   [LINK.BODY.IMAGE]
 
[ELEVATE.SPF.FAIL] has 100% hit on spam that might have gotten through or not deleted.  I have not seen a false positive but of course it does not mean it won't on other systems.
 
Regards,
Kami

Reply via email to