On Wednesday, November 2, 2005, 4:56:07 PM, Glenn wrote:
|
> |
I've had quite a lot of bounces (D/Q.GSE pairs) in the past several weeks due to users with full mailboxes, 99.999% of them are bounces on spam. When I examine the quoted headers in the D.GSE files, an appreciable number of them aren't failing any spam tests, and seems like many of them should at least be failing Sniffer.
|
I see these come to some of our spamtraps also --- the from address forged to match a harvested address... When they contain enough of the original spam we can use them to code new rules. I've not attempted to do this with third party submissions of bounces - it may be risky/confusing, but any time we can get our hands on new spam it's a good thing.
_M
