Chris,
This is what we've got for a rules.ima file. It's messy, but it works.
H~:in00!OR!H~:in01!OR!H~:in02!OR!H~:in03:main
H~:in04!OR!H~:in05!OR!H~:in06!OR!H~:in07:main
H~:in08!OR!H~:in09!OR!H~:in10!OR!H~:in11:main
H~:in12!OR!H~:in13!OR!H~:in14!OR!H~:in15:main
H~:in15!OR!H~:in16!OR!H~:in17!OR!H~:in18:main
H~:in19!OR!H~:in20:main
H~X-IMAIL-SPAM-DNSBL{2}!OR!H~X-IMAIL-SPAM-PHRASE!OR!H~X-IMAIL-SPAM-ADDRBL!OR
!H~X-IMAIL-SPAM-HELOBL!OR!H~X-IMAIL-SPAM-HELODOMAIN!OR!H~X-IMAIL-SPAM-INVALI
DFROM!OR!H~X-IMAIL-SPAM-IP4R!OR!H~X-IMAIL-SPAM-STATISTIC!OR!H~X-IMAIL-SPAM-R
HSBL!OR!H~X-IMAIL-SPAM-HTML-FEATURES!OR!H~X-IMAIL-SPAM-URL-DBL:SPAM
H~:k05!OR!H~:k06!OR!H~:k07!OR!H~:k08:SPAM
H~:k09!OR!H~:k10!OR!H~:k11!OR!H~:k12:SPAM
H~:k17!OR!B~:body0922_1!OR!B~:body0922!OR!B~:body0924:SPAM
H~:k13!OR!H~:k14!OR!H~:k15!OR!H~:k16:SPAM
B~Penis Enlargement Pill!AND!B~No Surgery! No Exercises!:SPAM
B~(Iraq|Iraqi)!AND!B~deck of playing cards:SPAM
B~HGH 1000!AND!B~CNN, and Oprah!AND!B~No strenuous exercise:SPAM
H=y0ung p0rn0!OR!H=YOUNGEST PORNO:SPAM
B~Our US Licensed Doctors will Prescribe Your Medication For
Free!OR!H~Viagra, Diet Pills:SPAM
B~ What celebrities do NOT want you to know ** !OR!B~Revolutionary Climax
Product Will Astonish You!:SPAM
B~:body0515!OR!B~:body0515_0!OR!B~:0516b0!OR!B~:body01:SPAM
B~:body00!OR!H~:header00!OR!B~:body0724_00!OR!B~:body0724_01:SPAM
H~:k01!OR!H~:k02!OR!H~:k03!OR!H~:k04:SPAM
H~:k18!OR!B~:body0929:SPAM
-Noe
----- Original Message -----
From: "Chris Hunt" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Thursday, October 09, 2003 2:42 PM
Subject: Re: [IMail Forum] X-Header for Content Filtering
> All I have is one line at the top of my rules.ima for X-Header. Do you
> mean you have more than one line? Could you email me your rules.ima?
>
> Chris
>
>
> At 02:00 PM 10/09/2003 -0500, you wrote:
> >Chris,
> >This was happening to us too. We recently removed the VALHELO,
VALREVDNS,
> >and VALFROM headers from our rule as they were catching more legit mail
than
> >spam. The change does not seem to have made that much of a difference in
the
> >amount of spam that's come through unblocked.
> >
> >Noe
> >
> >----- Original Message -----
> >From: "Chris Hunt" <[EMAIL PROTECTED]>
> >To: <[EMAIL PROTECTED]>
> >Sent: Thursday, October 09, 2003 1:30 PM
> >Subject: Re: [IMail Forum] X-Header for Content Filtering
> >
> >
> > >
> > > Noe, I get a lot of legit email that is caught by the VALFROM check
> > >
> > > How to you handle this issue?
> > >
> > > Chris
> > > [EMAIL PROTECTED]
> > >
> > >
> > > At 12:22 PM 10/09/2003 -0500, you wrote:
> > > >We have a rule that uses x-headers to filter spam in Imail 8.3. We
> >initially
> > > >ran into the same problem of too much legitimate mail getting blocked
and
> >we
> > > >were able to cut down on that by requiring that multiple instances of
the
> > > >x-headers be reached before a message is blocked.
> > > >For example:
> > > > H~X-IMAIL-SPAM-DNSBL{2}:SPAM
> > > >
> > > >We also configured the Content filtering (HTML) settings to require
that
> >at
> > > >least 3 "suspicious" html features must be present before an x-header
is
> > > >inserted.
> > > >
> > > >I'm not sure if this helps you, but it seems to be working well for
us
> >when
> > > >used with declude and the rest of Imail's spam features and a few
extra
> > > >white/black listing rules.
> > > >
> > > >Noe
> > > >
> > > >----- Original Message -----
> > > >From: "Mark Gordon" <[EMAIL PROTECTED]>
> > > >To: <[EMAIL PROTECTED]>
> > > >Sent: Thursday, October 09, 2003 10:16 AM
> > > >Subject: [IMail Forum] X-Header for Content Filtering
> > > >
> > > >
> > > >Does anyone have a rule setup to catch mail with the x-header insert
> >option
> > > >in 8.x? I had it setup to forward to my spambox, but seems that it
also
> > > >catch legit mail. I want to catch the x-headers to see what tripped
it
> >off
> > > >so I can remove those entires. Thanks
> > > >
> > > >To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
> > > >List Archive:
> >http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
> > > >Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
> > > >
> > > >
> > > >To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
> > > >List Archive:
> >http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
> > > >Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
> > > >---
> > > >[This E-mail scanned for viruses by Declude/F-Prot AV]
> > >
> > > ---
> > > [This E-mail scanned for viruses by Declude/F-Prot AV]
> > >
> > >
> >
> >
> >To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
> >List Archive:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
> >Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
> >---
> >[This E-mail scanned for viruses by Declude/F-Prot AV]
>
> ---
> [This E-mail scanned for viruses by Declude/F-Prot AV]
>
>
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
