On 10/03/2008 6:42 PM, John Hardin wrote:
> This just squeaked past my SA:
>
> {snip}
> Date: Mon, 10 Mar 2008 17:38:53 -0400
> from: "greg martind" <[EMAIL PROTECTED]>
> Message-ID: <[EMAIL PROTECTED]>
> MIME-Version: 1.0
> subject: [SPAM] GOOD EMPLOYMENT OFFER
> to: [EMAIL PROTECTED]
> X-Authenticated: #46068547
> {snip}
>
> The all-lowercase headers immediately caught my eye.
They're not uncommon in ham either, though.
> There doesn't appear to be a way to check for headers in a
> case-sensitive manner short of a plugin or (maybe) a "full" rule. Am I
> missing something?
>
> After a quick troll through my corpus it looks like from, to and subject
> headers all in lowercase might be a useful spam sign - if there was a
> way to check them.
Do header checks with the ALL, ALL-UNTRUSTED or ALL-EXTERNAL headers.
Daryl
