Hi all, I have a fedora15 install with postfix-2.8.7, and have a variation of spam that I'd like to block outright using a body check. I'm trying to figure out why one of my body checks isn't working. I have the following in my body_checks.pcre file for the patterns I've found:
/^Click here to see the attached photos\<\/a\>$/ REJECT /Click here to see the attached video/ REJECT I must be missing something with how body checks work. Perhaps as it relates to encoded mail? Is there an equivalent to $mime_header_checks for body checks, or is that not my problem? There is this content-type section involving the pattern to be found: --------------d058b513d2762cc0c3fbe363 Content-Type: text/html; charset="ISO-8859-1" Content-Transfer-Encoding: 7bit <b><span style="font-size: 26pt;"> <a alt="wr426lbdi6hxp6my9em asackcgcqa9aw2uq9oyp b99m88wql4kh9hkw799f" id="pgl2zds4k84pjgmoj1q nc9fttm7dfdi3ttdjqu1" href="d71b27vc8t0il7.xm1.me/sd_res...@cs.example.com/hicy jfazkmhacdbm27ks0r_ViewMsg" > Click here to see the attached photos</a> --------------d058b513d2762cc0c3fbe363-- I've also included the whole message on pastebin: http://pastebin.com/raw.php?i=p59KJmL5 I've read the filter README, which says to avoid using body checks for junk mail. Should I just instead create a spamassassin poison pill rule for this text, and just immediately convert the message to spam instead of trying to reject it before it's queued by postfix? Is there a way to measure the overhead I've created by the hundred or so other body checks I have in place, to see if it has significantly affected performance on my system? Can someone point me to how to properly reject messages with this content? Thanks, Alex
