Travis Crump([EMAIL PROTECTED]) is reported to have said: > Wayne Topa wrote: > >Richard Lyons([EMAIL PROTECTED]) is reported to have said: > > > >>On Friday 16 January 2004 22:23, Wayne Topa wrote: > >>[...] > >> > >>>I have a mailfilter rule that deletes mail without an > >>>originating Message-ID: and it has not had a false positive in over 3 > >>>months now. > >> > >>[...] > >>Would you care to share with those like me who can't immediately see how > >>to do it how exactly is that filter set up? > >> > > > >^Message-Id:.*smtp[0-9]\.your\.isp > > > >It is easy if you can find a spam message with your ISP in the > >Message-Id: header. ie > >egrep "^Message-Id:.*\.your\.isp" logs/mailfilterlog > > > >Note that my ISP, capital.net, is NOT what I found in the Message-ID. > >It was their smtp server address and it varied, so I had to write the > >rule accordingly. > > > >:-) HTH, YMMV, HAND :-) > >Wayne > > > > That rule would match roughly one third of my legitimate non-list > mail...[and only one fifth of my spam by comparison]
SCORE=100 SCORE -100 =^Message-Id:.*smtp[0-9]\.your\.isp Is how I use it, and as I said, "no false positives in over 3 months" I also said HTH=Hope This Helps, YMMV=Your Mileage May Vary, HAND=Have A Nice Day Wayne -- Real programmers don't draw flowcharts. Flowcharts are, after all, the illiterate's form of documentation. Cavemen drew flowcharts; look how much good it did them. _______________________________________________________ -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
