Re: Rule that negative scores emails from blackberry.com, not spoofers

2006-12-19 Thread Jan Doberstein
Hiya, Kelly Jones schrieb: > Reason I want to do this: by default, Blackberry sends text email > MIME-encoded and its timezone is +. This means it gets dinged by > the MIME_BASE64_TEXT rule AND the LW_STOCK_SPAM4 which is defined as: > > meta LW_STOCK_SPAM4 __RATWARE_0_TZ_DATE && MIME_BASE64_

Re: Rule that negative scores emails from blackberry.com, not spoofers

2006-12-18 Thread John D. Hardin
On Mon, 18 Dec 2006, Kelly Jones wrote: > The obvious: > > Received =~ /.*blackberry\.com$/ > > doesn't work, because someone could "HELO blackberry.com" or spoof a > blackberry.com received header somewhere in the message headers prior > to the last hop. ...so add enough to it to match only on