http://wiki.junkemailfilter.com/index.php/Spam_DNS_Lists#Familiar_Domains
These *might* work. I mangled together a couple types of tests:
header __RCVD_IN_FAMILIAR eval:check_rbl_envfrom('familiar',
'hostkarma.junkemailfilter.com.')
describe __RCVD_IN_FAMILIAR Received from IP in Hostkarma Familiar
tflags __RCVD_IN_FAMILIAR net
reuse __RCVD_IN_FAMILIAR
header RCVD_IN_LAST2DAYS eval:check_rbl_sub('familiar',
'127.0.2.1')
describe RCVD_IN_LAST2DAYS Received from IP first seen in last two
days
tflags RCVD_IN_LAST2DAYS net
reuse RCVD_IN_LAST2DAYS
header RCVD_IN_LAST10DAYS eval:check_rbl_sub('familiar',
'127.0.2.2')
describe RCVD_IN_LAST10DAYS Received from IP first seen in last ten
days
tflags RCVD_IN_LAST10DAYS net
reuse RCVD_IN_LAST10DAYS
I'd be curious to hear how that goes. And what would happen if they were
run through the weekly network mass checks.
On 11/16, Liam R. MacInnes wrote:
> "valid" SPF records. I'm looking for a way to increase the score for any
> message where the envelope-sender is an address at a domain registered
> in the previous 5 days. of course URIBL's won't help as they act on the
--
"I would believe only in a God that knows how to Dance." - Nietzsche
http://www.ChaosReigns.com
