Process on Message-ID header contents?
wolfgang at sweet-haven.com
Tue Sep 28 22:53:07 IST 2010
On 09/28/2010 01:49 PM, Steve Freegard wrote:
> On 28/09/10 20:26, Lew Wolfgang wrote:
>> The "phx.gbl" in the Message-ID header is common in all these spams, as
>> are the two addresses on the To: line.
> All mail from Hotmail/Live will have Message-IDs ending in @phx.gbl, so you don't want to add a rule for that.
> How about something like this (UNTESTED):
> header __TO_WOLFGANG To =~ /wolfgang\@sweet-haven\.com/i
> header __TO_WOLFGANG79 To =~ /wolfgang79\@live\.com/i
> meta LOCAL_WOLFGANG_SPAM (__TO_WOLFGANG && __TO_WOLFGANG79)
> score LOCAL_WOLFGANG_SPAM 5.0
Ah, I didn't know about the phx.gbl thing. This implies that the spam is being created organically by hotmail/live customers, right?
I'd rather not use a user-specific filter, there are about 350 other users on this MTA, most without local accounts.
Interesting problem, thanks for your help.
More information about the MailScanner