http://issues.apache.org/SpamAssassin/show_bug.cgi?id=5664
Summary: DYNAMIC check FPs
Product: Spamassassin
Version: 3.2.3
Platform: Other
OS/Version: other
Status: NEW
Severity: minor
Priority: P5
Component: Rules
AssignedTo: [email protected]
ReportedBy: [EMAIL PROTECTED]
header HELO_DYNAMIC_DHCP X-Spam-Relays-Untrusted =~ /^[^\]]+ helo=\S*(?:(?<!
a)cm|catv|docsis|cable|dsl|dhcp|cpe|node)\S*\d+[^\d\s]+\d+[^\]]+ auth= /i
header __RDNS_DYNAMIC_DHCP X-Spam-Relays-Untrusted =~ /^[^\]]+ rdns=\S*(?:cm|
catv|docsis|cable|dsl|dhcp|cpe|node)\S*\d+[^\d\s]+\d+/i
The "cm" part is FP prone:
cmw2kex02e.rvc.ac.uk
cm0.mx.agent.point2.com
cmdeliver0.st0.spray.net
cmfilter0-ens.phx0m.ensynch.com
cmx0.servicemail24.de
hchlilmtcm0a0.mcleodusa.net
trafficmatt0.clnt.800hosting.net
Maybe change it to (\b|\d)cm(\b|\d).
Also "node" is FP prone:
mail-node-0.i-55.com
node0-www.care2.com
node0.mail0.netdiscounter.de
You should check when stuff like (mx|mail|smtp|www|filter) to negate these.
For some ideas, you can check http://sa.hege.li/badrelay.cf for entries that
I've been collecting.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
