I note that a simple router reject does not appear to log the keyword "SPAM?", as in
11:31:12 1 SMTP-809(howdy.etracks.com) Return-Path '<[EMAIL PROTECTED]>' rejected: routed to ERROR OTOH, an unknown user does: 11:26:42 1 SMTP-803([65.167.146.55]) SPAM? Recipient '<[EMAIL PROTECTED]>' rejected: user unknown I would argue that the former is much more likely to be spam (many of my router entries are for this purpose) and so should have the keyword added so it can be picked up when filtering the log. FWIW, I would still argue to keep the keyword on unknown users, because although it -seems- less likely to be spam (misspelling for example), it still turns out (for me anyway) that it mostly is. Stefan Jeglinski ############################################################# This message is sent to you because you are subscribed to the mailing list <[EMAIL PROTECTED]>. To unsubscribe, E-mail to: <[EMAIL PROTECTED]> To switch to the DIGEST mode, E-mail to <[EMAIL PROTECTED]> To switch to the INDEX mode, E-mail to <[EMAIL PROTECTED]> Send administrative queries to <[EMAIL PROTECTED]>
