Re: [Declude.JunkMail] CBL:Fw: news

[Scott Fisher]

basically it will end the filter if any of the statements are not true.   These stock emails have always met these 4 criteria, so if it doesn't meet them end the filter.   1. contains a gif attachment hence:Content-Type: image/gif 2&3.  contains a header like:  Received: from unknown (HELO randomword [192.168. 4.  Always fails cmdspace You could use mine and Kevin's combined:   BODY  END NOTCONTAINS Content-Type: image/gif HEADERS  END NOTCONTAINS Received: from unknown (HELO HEADERS  END NOTCONTAINS [192.168. TESTSFAILED END NOTCONTAINS CMDSPACE   BODY 15 CONTAINS <img src=""> ----- Original Message ----- From: Todd To: Declude.JunkMail@declude.com Sent: Tuesday, December 06, 2005 3:28 PM Subject: Re: [Declude.JunkMail] CBL:Fw: news Scott,    I am looking through the Declude manual to determine what you are doing.  I don't think I understand NOTCONTAINS. I would think CONTAINS mean it has this string in the body and NOTCCONTAINS means it does not.  So why NOTCONTAINS Content-Type: image/gif    ?   I feel like I am probably missing something painfully obvious here.   Todd     ----- Original Message ----- From: Scott Fisher To: Declude.JunkMail@declude.com Sent: Tuesday, December 06, 2005 1:50 PM Subject: Re: [Declude.JunkMail] CBL:Fw: news I use this filter:   STOPATFIRSTHIT   BODY  END NOTCONTAINS Content-Type: image/gif HEADERS  END NOTCONTAINS Received: from unknown (HELO HEADERS  END NOTCONTAINS [192.168. TESTSFAILED END NOTCONTAINS CMDSPACE   TESTSFAILED 100 CONTAINS HELO-IS-REVDNS TESTSFAILED 100 CONTAINS HELOISIP TESTSFAILED 50 CONTAINS REVDNS-TIMEOUT   HELOISIP and HELO-IS-REVDNS are from external tests that I run. ----- Original Message ----- From: Richard Farris To: Declude.JunkMail@declude.com Sent: Tuesday, December 06, 2005 1:25 PM Subject: [Declude.JunkMail] CBL:Fw: news Does anyone have an answer to filter these type emails? Richard Farris Ethixs Online 1.270.247.5555 Office 1.800.548.3877 Tech Support "Crossroads to a Cleaner Internet" ----- Original Message ----- From: [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Tuesday, December 06, 2005 3:20 AM Subject: news