On 10/03/2008 8:15 PM, John Hardin wrote:
> On Mon, 10 Mar 2008, Daryl C. W. O'Shea wrote:
>
>> On 10/03/2008 6:42 PM, John Hardin wrote:
>>> This just squeaked past my SA:
>>>
>>> {snip}
>>> Date: Mon, 10 Mar 2008 17:38:53 -0400
>>> from: "greg martind" <[EMAIL PROTECTED]>
>>> Message-ID: <[EMAIL PROTECTED]>
>>> MIME-Version: 1.0
>>> subject: [SPAM] GOOD EMPLOYMENT OFFER
>>> to: [EMAIL PROTECTED]
>>> X-Authenticated: #46068547
>>> {snip}
>>>
>>> The all-lowercase headers immediately caught my eye.
>>
>> They're not uncommon in ham either, though.
>
> See my followup - I was speaking of the header *names* being all
> lowercase, not their content. Sorry for not making that clearer in my
> initial post.
I thought your initial post was clear. The header field names are lower
case.
>>> There doesn't appear to be a way to check for headers in a
>>> case-sensitive manner short of a plugin or (maybe) a "full" rule. Am I
>>> missing something?
>>>
>>> After a quick troll through my corpus it looks like from, to and subject
>>> headers all in lowercase might be a useful spam sign - if there was a
>>> way to check them.
>>
>> Do header checks with the ALL, ALL-UNTRUSTED or ALL-EXTERNAL headers.
>
> Does that let you check the header names? Or just the content of headers
> regardless of their name?
Yes, it does. See the M::SA::PerMsgStatus POD.
Daryl
