I tried that - "CONTAINS" would catch that variation anyway. However, the real answer is to add "IGNORE" or "WARN" to the $Junkmail$ file. I've gone through this before - and I just couldn't remember what it was...
Best Regards Andy Schmidt Phone: +1 201 934-3414 x20 (Business) Fax: +1 201 934-9206 -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Scott Fisher Sent: Saturday, April 09, 2005 09:45 AM To: Declude.JunkMail@declude.com Subject: Re: [Declude.JunkMail] Tip: Eliminating SPF domains from SpamDomains The negative tests show up in the log with a lower case "n" in front of them: nNOLEGITCONTENT You might try that. ----- Original Message ----- From: "Andy Schmidt" <[EMAIL PROTECTED]> To: <Declude.JunkMail@declude.com> Sent: Friday, April 08, 2005 4:39 PM Subject: RE: [Declude.JunkMail] Tip: Eliminating SPF domains from SpamDomains > Well, I spent a good portion of today experimenting with a Filter that > could > combine Sniffer, invURIBL and NOLEGITCONTENT... However, it seems as if > NOLEGITCONTENT is never found in the "TESTFAILED" list? > >>From what I could see a "TESTFAILED CONTAINS NOLEGITCONTENT" is never >>true? > > So - I wonder whether IPNOTINMX suffers the same. > > > Best Regards > Andy Schmidt > > Phone: +1 201 934-3414 x20 (Business) > Fax: +1 201 934-9206 > > > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, > Andrew > Sent: Friday, April 08, 2005 05:30 PM > To: Declude.JunkMail@declude.com > Subject: RE: [Declude.JunkMail] Tip: Eliminating SPF domains from > SpamDomains > > > ... Another double-hit involving SPF would be to marry the logic of > IPNotInMX and SPF PASS/FAIL; if you have SPF records for the domain, > you don't need IPNotInMX. > > Sorry, no working sample. Putting that into a Declude test has been > on my to-do-list for a long time. > > Andrew 8) > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Matt (Forums) > Sent: Friday, April 08, 2005 2:19 PM > To: Declude.JunkMail@declude.com > Subject: Re: [Declude.JunkMail] Tip: Eliminating SPF domains from > SpamDomains > > > FYI, Sniffer also has some tests that are similar to SPAMDOMAINS that > were formerly causing me double-hits on false positives on my system. > Pete has this stuff seemingly coded up into a group and it can be > turned off easily if you request it from him. > > Matt > > > ---------- Original Message ---------------------------------- > From: "Andy Schmidt" <[EMAIL PROTECTED]> > Reply-To: Declude.JunkMail@declude.com > Date: Fri, 8 Apr 2005 10:28:40 -0400 > >>Hi, >> >>I'm always seeking to eliminate "double failures" for single facts to >>prevent false positives and then "up" the weight for groups of tests >>that test the same facts. >> >>Several domains that I used to have in SpamDomains (such as >>"Excite.com") are publishing SPF. >> >>I used the following DLanalyzer "Advanced" report to find all domains >>that failed SpamDomains AND triggered SPFFAIL and then removed them >>from SpamDomains... >> >>Advanced Report >> >>4/1/2005 9:22:37 PM Subject ......: Atkins Pharmacy >> Q01E0877D00C06E74 From .........: [EMAIL PROTECTED] >> 1 Recipient(s): [EMAIL PROTECTED] >> 2 Test(s) ...: SPAMDOMAINS, SPFFAIL >> >>4/3/2005 10:49:57 AM Subject ......: Top 10 meds bought online >> Q0287746D006853C6 From .........: [EMAIL PROTECTED] >> 1 Recipient(s): [EMAIL PROTECTED] >> 2 Test(s) ...: SPAMDOMAINS, SPFFAIL >> >>etc... >> >> >> >>Best Regards >>Andy Schmidt >> >>Phone: +1 201 934-3414 x20 (Business) >>Fax: +1 201 934-9206 >> >> >> >> > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > "unsubscribe Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > "unsubscribe Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > "unsubscribe Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. > --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
