Re: [Declude.JunkMail] General Filter

[Matt]

Orin, Declude unfortunately scans the entire undecoded message with BODY or ANYWHERE filters.  Because base64 encoding uses mostly letters and numbers, larger attachments can hit shorter words such as the one you pointed out.  As a rule of thumb, you should add a space to the end of the word in your filter file if it is 5 or fewer characters.  base64 encoding can't have spaces in it so that will prevent it from hitting.  This technique can also prevent hits on words that aren't intended.  For instance po rnographic would also hit your filter, but you might not want to ban that word, and adding a space would prevent this from happening. You may find that filtering for baned words is not a constructive use of time due to the false positives that it can cause and the time spent dealing with issues.  Ditching the filter and paying $325/year for Sniffer would net far better results, and the price is generally very reasonable for a server. Matt Orin Wells wrote: I am having a problem with a client whose email to other members of her domain is getting trapped by the GeneralFilter (words or phrases we have added because they seem to mostly appear in spam).  In this particular case the triggering word seems to be P*O*R*N* without the stars. I suspect what is happening is that the encoded attached word document just happens to have this set of letters in sequence in the encrypted data that is attached to the email file in imail.  It does not appear in the word document itself.  But when I look at the raw file on the server I can see this. I take it from this that Declude when it scans the body of the message also scans any attachment that is sitting there in the encrypted mode.  If so is there a way around this?  Can I tell it not to scan the encrypted attachments or to expand them first?  If this sort of thing is in the latest Declude Junkmail manual, someone just tell me to read TFM. --- This E-mail came from the Declude.JunkMail mailing list.  To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail".  The archives can be found at http://www.mail-archive.com.