Hi, I received such a legitimate mail:
Received: from GTEW2KPR07 by marketing.grouppoint.at
(MDaemon.Standard.v7.2.2.R)
with ESMTP id pd50000008044.msg
for <[EMAIL PROTECTED]>; Fri, 07 Apr 2006 11:26:25 +0200
Message-ID:
<[EMAIL PROTECTED]>
From: "GROUP POINT News" <[EMAIL PROTECTED]>
To: "GROUP POINT News" <[EMAIL PROTECTED]>
Subject: Server Angebot April 2006
Date: Fri, 7 Apr 2006 11:25:16 +0200
MIME-Version: 1.0
Content-Type: multipart/related;
type="multipart/alternative";
boundary="----=_NextPart_000_0045_01C65A35.F1EF82D0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1506
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1506
X-Authenticated-Sender: [EMAIL PROTECTED]
X-MDRemoteIP: 10.1.1.101
Sender: [EMAIL PROTECTED]
X-Return-Path: [EMAIL PROTECTED]
X-MDMailing-List: [EMAIL PROTECTED]
X-MDSend-Notifications-To: [EMAIL PROTECTED]
Reply-To: [EMAIL PROTECTED]
X-MDaemon-Deliver-To: [EMAIL PROTECTED]
X-Virus-Scanned: amavisd-new at goelsen.net
X-Virus-Scanned: amavisd-new at zmi.at
X-Spam-Status: Yes, hits=5.724 tagged_above=-999 required=5
tests=AWL=-0.275,
DNS_FROM_RFC_POST=1.44, EXTRA_MPART_TYPE=0.815,
FORGED_MUA_OUTLOOK=3.36,
HTML_FONT_BIG=0.256, HTML_MESSAGE=0.001, HTML_TAG_EXIST_TBODY=0.126,
UNPARSEABLE_RELAY=0.001
X-Spam-Level: *****
X-Spam-Flag: YESI believe it hits FORGED_MUA_OUTLOOK because MDAEMON modifies the Message-ID. So there should be a rule allowing MDAEMON like header __OE_MSGID_4 MESSAGEID =~ /^<[EMAIL PROTECTED]>$/m Any other ideas? mfg zmi -- // Michael Monnerie, Ing.BSc ----- http://it-management.at // Tel: 0660/4156531 .network.your.ideas. // PGP Key: "lynx -source http://zmi.at/zmi3.asc | gpg --import" // Fingerprint: 44A3 C1EC B71E C71A B4C2 9AA6 C818 847C 55CB A4EE // Keyserver: www.keyserver.net Key-ID: 0x55CBA4EE
pgpgd9mZxMKOh.pgp
Description: PGP signature
