On Tue, 29 Sep 2015, Philip Prindeville wrote:
Can you use something like:
header __L_X_NO_RELAY exists:X-No-Relay
tflags __L_X_NO_RELAY multiple
See also DUP_SUSP_HDR, which is in my sandbox but isn't performing well
enough against the corpora to get published:
http://ruleqa.spamassassin.org/20150926-r1705400-n/%2FDUP_SUSP_HDR
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
Homeland Security: Specializing in Tactical Band-aids for Strategic
Problems. -- Eric K. in Bruce Schneier's blog
-----------------------------------------------------------------------
