Re: Undisclosed recipients :; -- again

2009-12-02 Thread Philip A. Prindeville
On 11/30/2009 03:15 AM, Matus UHLAR - fantomas wrote: On 27.11.09 14:04, Philip A. Prindeville wrote: for the ruleset: header __L_UNDISCLOSED1 To:raw =~ /undisclosed-recipients: ;/ just FYI, sendmail can be configured to do different things when To: is missing -

Re: Undisclosed recipients :; -- again

2009-11-30 Thread Matus UHLAR - fantomas
On 27.11.09 14:04, Philip A. Prindeville wrote: for the ruleset: header __L_UNDISCLOSED1 To:raw =~ /undisclosed-recipients: ;/ just FYI, sendmail can be configured to do different things when To: is missing - there's sendmail option NoRecipientAction, configured by setting

Re: Undisclosed recipients :; -- again

2009-11-27 Thread Philip A. Prindeville
John Hardin wrote: On Mon, 23 Nov 2009, LuKreme wrote: On Nov 23, 2009, at 12:05, Philip Prindeville philipp_s...@redfish-solutions.com wrote: I want to block all messages that I'm getting that have: To: undisclosed recipients: ; undisclosed recipients is used for Bcc: mail I used it

Re: Undisclosed recipients :; -- again

2009-11-27 Thread John Hardin
On Fri, 27 Nov 2009, Philip A. Prindeville wrote: header __L_UNDISCLOSED1 To:raw =~ /undisclosed-recipients: ;/ Just how do I go about figuring out what the To:raw value is (for example)? header __TO_RAW To:raw =~ /.+/ If you're analyzing something that may have multiple

Re: Undisclosed recipients :; -- again

2009-11-27 Thread Philip A. Prindeville
John Hardin wrote: On Fri, 27 Nov 2009, Philip A. Prindeville wrote: header __L_UNDISCLOSED1 To:raw =~ /undisclosed-recipients: ;/ Just how do I go about figuring out what the To:raw value is (for example)? header __TO_RAW To:raw =~ /.+/ If you're analyzing something that may

Re: [sa] Re: Undisclosed recipients :; -- again

2009-11-24 Thread Charles Gregory
On Mon, 23 Nov 2009, John Hardin wrote: Granted, but in metas such a test can be useful: http://ruleqa.spamassassin.org/?rule=%2FTO_NOsrcpath=jhardin Every now and then, someone posts a link like this one, and I find myself looking at a kind of 'index' page that frankly doesn't mean a thing

Undisclosed recipients :; -- again

2009-11-23 Thread Philip Prindeville
Hi. I want to block all messages that I'm getting that have: To: undisclosed recipients: ; with no Cc: line. Unfortunately, the rule that I have: header L_UNDISCLOSEDTo:raw =~ /undisclosed-recipients: ?;/ describe L_UNDISCLOSED To: list is meaningless and no Cc: score

Re: Undisclosed recipients :; -- again

2009-11-23 Thread Michael Scheidell
Philip Prindeville wrote: Hi. I want to block all messages that I'm getting that have: To: undisclosed recipients: ; with no Cc: line. I went round and round with this a while back. SA 3.25 has a problem with perl null vs 0 vs ''. so a To header (or CC header) with no content looks

Re: Undisclosed recipients :; -- again

2009-11-23 Thread Philip Prindeville
On 11/23/2009 12:10 PM, Michael Scheidell wrote: Philip Prindeville wrote: Hi. I want to block all messages that I'm getting that have: To: undisclosed recipients: ; with no Cc: line. I went round and round with this a while back. SA 3.25 has a problem with perl null vs 0

Re: Undisclosed recipients :; -- again

2009-11-23 Thread Michael Scheidell
Philip Prindeville wrote: but as you say, if it can't tell the difference between and undef, then that's an issue. use header ALL to check for a \nCC (which could be blank) or just use your MTA to reject it at SMTPtime.

Re: Undisclosed recipients :; -- again

2009-11-23 Thread Philip Prindeville
On 11/23/2009 12:18 PM, Michael Scheidell wrote: Philip Prindeville wrote: but as you say, if it can't tell the difference between and undef, then that's an issue. use header ALL to check for a \nCC (which could be blank) or just use your MTA to reject it at SMTPtime.

Re: Undisclosed recipients :; -- again

2009-11-23 Thread LuKreme
On Nov 23, 2009, at 12:05, Philip Prindeville philipp_s...@redfish-solutions.com wrote: I want to block all messages that I'm getting that have: To: undisclosed recipients: ; with no Cc: line. What's Cc: have to do with it? undisclosed recipients is used for Bcc: mail I used it all

Re: Undisclosed recipients :; -- again

2009-11-23 Thread Benny Pedersen
On tir 24 nov 2009 01:11:38 CET, LuKreme wrote I used it all the time. And you WILL 'block' legitimate mail. and thats always sender to decide its legitimate :) i see a pattern there -- xpoint

Re: Undisclosed recipients :; -- again

2009-11-23 Thread John Hardin
On Mon, 23 Nov 2009, LuKreme wrote: On Nov 23, 2009, at 12:05, Philip Prindeville philipp_s...@redfish-solutions.com wrote: I want to block all messages that I'm getting that have: To: undisclosed recipients: ; undisclosed recipients is used for Bcc: mail I used it all the time. And you

Re: Undisclosed recipients :; -- again

2009-11-23 Thread Philip Prindeville
On 11/23/2009 05:11 PM, LuKreme wrote: On Nov 23, 2009, at 12:05, Philip Prindeville philipp_s...@redfish-solutions.com wrote: I want to block all messages that I'm getting that have: To: undisclosed recipients: ; with no Cc: line. What's Cc: have to do with it?

Re: Undisclosed recipients :; -- again

2009-11-23 Thread Philip Prindeville
On 11/23/2009 05:11 PM, LuKreme wrote: On Nov 23, 2009, at 12:05, Philip Prindeville philipp_s...@redfish-solutions.com wrote: I want to block all messages that I'm getting that have: To: undisclosed recipients: ; with no Cc: line. What's Cc: have to do with it?