> How can I see in mail header about if network tests run?
You would see tests like SURBL and other net tests hitting. For instance:
1.2 RCVD_IN_BL_SPAMCOP_NET RBL: Received via a relay in bl.spamcop.net
[Blocked - see
<http://www.spamcop.net/bl.shtml?222.100.230.130>]
3.1 RCVD_IN_XBL RBL: Received via a relay in Spamhaus XBL
[222.100.230.130 listed in sbl-xbl.spamhaus.org]
1.6 DNS_FROM_RFC_POST RBL: Envelope sender in
postmaster.rfc-ignorant.org
1.0 URIBL_SBL Contains an URL listed in the SBL blocklist
[URIs: iprohealth.info]
0.4 URIBL_AB_SURBL Contains an URL listed in the AB SURBL blocklist
[URIs: iprohealth.info]
4.0 URIBL_JP_SURBL Has URI in JP at http://www.surbl.org/lists.html
[URIs: iprohealth.info]
1.5 URIBL_WS_SURBL Contains an URL listed in the WS SURBL blocklist
[URIs: iprohealth.info]
3.2 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist
[URIs: iprohealth.info]
4.3 URIBL_SC_SURBL Contains an URL listed in the SC SURBL blocklist
[URIs: iprohealth.info]
All of those are network tests. There are also more than that.
> Is it enough to not post the mail bodies, only the headers here to get
> helped to set better rules?
We can tell you what hit from the headers and possibly suggest things from
that. To be definitive we would need to see the body also.
However, as a general rule if you get net tests working and perhaps pick up
some rules from rulesemporium, you should be doing pretty well.
Loren
