> FROMDOMAIN 50 IS %HELO% Shouldn't this be so for legit messages?
I can see certain spam messages where the RECIPIENT-domain for the local user is also part of the HELO string. Maybe it would be usefull to set up a text filter like STOPATFIRSTHIT HELO 10 CONTAINS localdomain1.com HELO 10 CONTAINS localdomain2.com HELO 10 CONTAINS localdomain3.com HELO 10 CONTAINS localdomain4.com ... Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
