I've modified my rule and made sure it lints (attached as nick.cf) but
it still doesn't match messages like the one below! Can anyone see why?
Nick....
---
From - Thu Jun 03 16:12:21 2004
X-Mozilla-Status: 0001
X-Mozilla-Status2: 00000000
Return-Path: <>
Delivered-To: [EMAIL PROTECTED]
Received: (qmail 28507 invoked for bounce); 3 Jun 2004 15:11:06 -0000
Date: 3 Jun 2004 15:11:06 -0000
From: [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Subject: failure notice
X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on red.x-rm.com
X-Spam-Status: No, hits=-4.7 required=5.0 tests=BAYES_00,NO_REAL_NAME
autolearn=no version=2.63
X-Spam-Level:
Hi. This is the qmail-send program at red.x-rm.com.
I'm afraid I wasn't able to deliver your message to the following addresses.
This is a permanent error; I've given up. Sorry it didn't work out.
<[EMAIL PROTECTED]>:
195.166.37.20 does not like recipient.
Remote host said: 550 <[EMAIL PROTECTED]>, Recipient unknown
Giving up on 195.166.37.20.
--- Below this line is a copy of the message.
Return-Path: <[EMAIL PROTECTED]>
Received: (qmail 28505 invoked from network); 3 Jun 2004 15:11:05 -0000
Received: from neon.staging.x-rm.com (HELO ?127.0.0.1?) (195.166.37.20)
by 0 with SMTP; 3 Jun 2004 15:11:05 -0000
Message-ID: <[EMAIL PROTECTED]>
Date: Thu, 03 Jun 2004 16:11:58 +0100
From: Nick Gilbert <[EMAIL PROTECTED]>
User-Agent: Mozilla Thunderbird 0.6+ (Windows/20040527)
X-Accept-Language: en
MIME-Version: 1.0
To: [EMAIL PROTECTED]
Subject: test
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
test
# ---------- BOUNCE DETECTION (stolen from bogus_virus_warnings.cf)---------
# General rule to indicate bounce or otherwise - used for some other rules
header __BOUNCE_HEADER X-Is-A-Bounce =~ /.+/
# This won't match for scanning done at SMTP time, at least with Exim
header __BOUNCE_RP1 Return-Path =~ /^<>$/
# NL says this is added by amavisd-new before passing to SA
header __BOUNCE_RP2 X-Return-Path =~ /^<>$/
# Mark Martinec says the above is incorrect, and it's X-Envelope-From
header __BOUNCE_RP3 X-Envelope-From =~ /^<>$/
meta __NULL_SENDER __BOUNCE_HEADER || __BOUNCE_RP1 || __BOUNCE_RP2
|| __BOUNCE_RP3
# Thanks to AF
header __CT_DEL_STATUS Content-Type =~ /report-type=delivery-status/
meta __NICK_IS_A_BOUNCE __NULL_SENDER || __CT_DEL_STATUS
header __NICK_BOUNCE_RETURNPATH Return-Path =~ /<>/i
header __NICK_BOUNCE_REAL To =~ /[EMAIL PROTECTED]/i
body __NICK_BOUNCE_SPOOF_SENDER /^To:[EMAIL PROTECTED]/i
meta NICK_SPOOF_BOUNCE ((__NICK_BOUNCE_RETURNPATH && __NICK_IS_A_BOUNCE &&
__NICK_BOUNCE_SPOOF_SENDER) && (!NICK_BOUNCE_REAL))
score NICK_SPOOF_BOUNCE 5.0
describe NICK_SPOOF_BOUNCE "Attached bounce contains my address but I never
sent this!"
