From: linuxbox <[EMAIL PROTECTED]>
   Date: Thu, 16 Oct 2008 08:02:23 -0700 (PDT)
   
   Hello there.  I have a problem with blocking an email with spamassassin. 
   normally when i want to block a domain in an email, be it html or plain text
   i would have a rule such as this, and this works perfectly:
   
   rawbody spam_domains /blockeddomain\.com/i
   however today i received an email in this format and it does not get blocked
   by my rawbody rule that includes the domain i wish to block.  the src code
   of the email is in the code snippet below
   ...   
   full spam_domains /yourpening\.com/i
   score spam_domains 20
   
   can anyone show me a rule or something in spamassassin that would block
   email with that domain?
   
   here is the email source:
   
   Return-Path: <[EMAIL PROTECTED]>
   ...
   X-Spam-Status: No, hits=0.0 required=5.0
        tests=TOTAL_SCORE: 0.000

The X-Spam-Status line on the message is suspicious.
Was this header in the original message or did your SpamAssassin add this?

How are you calling SpamAssassin?  Are you using procmail or something
that skips messages that already have a X-Spam-Status line?

Also, as already pointed out, use uri rules instead of full or rawbody.

-jeff

Reply via email to