Process on Message-ID header contents?

[Lew Wolfgang]

  On 09/28/2010 01:49 PM, Steve Freegard wrote:
> On 28/09/10 20:26, Lew Wolfgang wrote:
>> The "phx.gbl" in the Message-ID header is common in all these spams, as
>> are the two addresses on the To: line.
>
> All mail from Hotmail/Live will have Message-IDs ending in @phx.gbl, so you don't want to add a rule for that.
>
> How about something like this (UNTESTED):
>
> header __TO_WOLFGANG    To =~ /wolfgang\@sweet-haven\.com/i
> header __TO_WOLFGANG79  To =~ /wolfgang79\@live\.com/i
> meta LOCAL_WOLFGANG_SPAM (__TO_WOLFGANG && __TO_WOLFGANG79)
> score LOCAL_WOLFGANG_SPAM 5.0

Hi Steve,

Ah, I didn't know about the phx.gbl thing.  This implies that the spam is being created organically  by hotmail/live customers, right?

I'd rather not use a user-specific filter, there are about 350 other users on this MTA, most without local accounts.

Interesting problem, thanks for your help.

Regards,
Lew