Declude can not do this so your only option is to write an external test to plug into declude and pass the variables %HELO% and %MAILFROM%.
Kevin Bilbee > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] Behalf Of Dan Geiser > Sent: Monday, January 31, 2005 9:39 AM > To: [email protected] > Subject: Re: [Declude.JunkMail] Add Points if Domain Name IS Hello > > > Andy, > That is not what typically what I see on most legit incoming e-mails. > > For example here is a legit customer e-mail I picked it random (with a few > things obfuscated)... > > X-Declude-Sender: [EMAIL PROTECTED] [152.63.54.131] > X-Note: This E-mail was scanned & filtered by Declude [1.82] for SPAM & > viruses. > X-Country-Chain: UNITED STATES->destination > X-Note: Recipient(s): [EMAIL PROTECTED] > X-Note: Sent with HELO [mail13.somedepartment.state.oh.us] from > Reverse DNS > [mail13.somedepartment.state.oh.us] > X-Spam-Tests-Failed: NOABUSE [-76] > > In this example the HELO contains "somedepartment.state.oh.us". That is > true, but what I am seeing is where the HELO IS > "somedepartment.state.oh.us" > which in this case is NOT true. The HELO is > "mail13.somedepartment.oh.us". > And in fact 99% of legit e-mails that I see the whole string used in the > HELO is NOT identical to the string after the '@' symbol. Especially when > you are talking about the big free web mail providers. The only 2 that I > know of that use a simple HELO, e.g. domain.com, are HOTMAIL.COM and > EXCITE.COM. Everybody else uses a long host name, e.g. subnet.domain.com, > and I can easily put exceptions in for HOTMAIL.COM and EXCITE.COM. > > What I've been seeing, using the same headers as above, is... > > X-Declude-Sender: [EMAIL PROTECTED] [152.63.54.131] > X-Note: This E-mail was scanned & filtered by Declude [1.82] for SPAM & > viruses. > X-Country-Chain: UNITED STATES->destination > X-Note: Recipient(s): [EMAIL PROTECTED] > X-Note: Sent with HELO [somedepartment.state.oh.us] from Reverse DNS > [mail13.somedepartment.state.oh.us] > X-Spam-Tests-Failed: NOABUSE [-76] > > If the text after the @ symbol was broken out into it's own variable, e.g. > FROMHOST = "somedepartment.state.oh.us", and the helo was broken out into > it's own variable, e.g. HELO = "somedepartment.oh.us", then if I could do > the following... > > FROMHOST 50 IS %HELO% > > then I could add to the weight of a bunch of e-mails that are currently > making it through. > > Regardless I wasn't looking for feedback on the likelihood of this idea > working well. All I wanted to know if it was technically feasible. In a > weight based system even if I can add a few points, if only > enough to raise > the weight a little yet not enough to push legit e-mail over my > HOLD weight, > then that's what I'm looking to do. > > Thanks, > Dan > > ----- Original Message ----- > From: "Andy Schmidt" <[EMAIL PROTECTED]> > To: <[email protected]> > Sent: Monday, January 31, 2005 10:29 AM > Subject: RE: [Declude.JunkMail] Add Points if Domain Name IS Hello > > > Dan, > > May be I misunderstand - but is this exactly what you SHOULD see, e.g., > unless it's a virtual hosting environment or shared SMTP server you SHOULD > see that the sender domain and HELO domain is identical? > > This would be equivalent to testing if headers are RFC compliant - and if > so, to throw out most of the good mail with the bad because it too happens > to comply with RFCs? > > Best Regards > Andy Schmidt > > Phone: +1 201 934-3414 x20 (Business) > Fax: +1 201 934-9206 > > > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Dan Geiser > Sent: Monday, January 31, 2005 10:13 AM > To: [email protected] > Subject: [Declude.JunkMail] Add Points if Domain Name IS Hello > > > Hello, All, > I've been getting tons of spam where the domain name used in the sender, > e.g. [EMAIL PROTECTED], exactly matches the helo, e.g. justasailor.com. > > Is there any way to set up a test to add points if these 2 are > identical? I > was thinking there might be a way to do it using the variables > that Declude > creates but I don't know exactly what the syntax would be and I don't know > if Declude parses out the domain name into it's own variable. > But if there > were such a variable I'm thinking something along the lines of... > > FROMDOMAIN 50 IS %HELO% > > Thanks In Advance, > Dan Geiser > > > > > ------------------------------------------------------------------- > E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, > just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe > Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. > > --- > [This E-mail was scanned for viruses by Declude Virus > (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > ------------------------------------------------------------------- > E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) > > > > ------------------------------------------------------------------- > E-mail scanned for viruses by Nexus (http://www.ntgrp.com/mailscan) > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
