I've changed my sendmail configuration to be more verbose about the authentication information.
To add to this, I've discovered that it can match any token in the Received: line that does NOT include an equals sign in it: Received: from [132.177.124.246] (doombox.iol.unh.edu [132.177.124.246]) (user=mikecrelay mech=PLAIN bits=0) by postal.iol.unh.edu (8.14.0/8.14.0) with ESMTP id l5KFMexj024714 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT) for <[EMAIL PROTECTED]>; Wed, 20 Jun 2007 11:22:41 -0400 Examples that will not match: user=mikecrelay mech=PLAIN bits=0 version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NOT Every other token matches my test filters ok. -- View this message in context: http://www.nabble.com/a-rule-to-allow-authenticated-users-stopped-working%2C-unless-run-at-user-level-tf3952490.html#a11215794 Sent from the SpamAssassin - Users mailing list archive at Nabble.com.