Re: tflags multiple and header exists:

2015-09-29 Thread John Hardin
On Tue, 29 Sep 2015, Philip Prindeville wrote: On Sep 29, 2015, at 10:44 AM, John Hardin wrote: On Tue, 29 Sep 2015, Philip Prindeville wrote: Can you use something like: header __L_X_NO_RELAY exists:X-No-Relay Are you seeing empty X-No-Relay headers? How about: No, not empty.

Re: tflags multiple and header exists:

2015-09-29 Thread Philip Prindeville
On Sep 29, 2015, at 10:44 AM, John Hardin wrote: > On Tue, 29 Sep 2015, Philip Prindeville wrote: > >> Can you use something like: >> >> header __L_X_NO_RELAYexists:X-No-Relay > > Are you seeing empty X-No-Relay headers? How about: No, not empty. Typically they say: X-No-Re

Re: tflags multiple and header exists:

2015-09-29 Thread John Hardin
On Tue, 29 Sep 2015, Philip Prindeville wrote: Can you use something like: header __L_X_NO_RELAY exists:X-No-Relay tflags __L_X_NO_RELAY multiple See also DUP_SUSP_HDR, which is in my sandbox but isn't performing well enough against the corpora to get published: http://

Re: tflags multiple and header exists:

2015-09-29 Thread John Hardin
On Tue, 29 Sep 2015, John Hardin wrote: On Tue, 29 Sep 2015, Philip Prindeville wrote: Can you use something like: header __L_X_NO_RELAY exists:X-No-Relay Are you seeing empty X-No-Relay headers? How about: header__HAS_NO_RELAYX-No-Relay =~ /./ Oops. If yo

Re: tflags multiple and header exists:

2015-09-29 Thread John Hardin
On Tue, 29 Sep 2015, Philip Prindeville wrote: Can you use something like: header __L_X_NO_RELAY exists:X-No-Relay Are you seeing empty X-No-Relay headers? How about: header__HAS_NO_RELAYX-No-Relay =~ /./ ...which is in my sandbox, but just for eval, it's not

Re: tflags multiple and header exists:

2015-09-29 Thread Philip Prindeville
On Sep 29, 2015, at 10:09 AM, Philip Prindeville wrote: > Can you use something like: > > header __L_X_NO_RELAY exists:X-No-Relay > tflags __L_X_NO_RELAY multiple Actually, that should probably be bounded to something like: tflags __L_X_NO_RELAY multiple maxhits=10

tflags multiple and header exists:

2015-09-29 Thread Philip Prindeville
Can you use something like: header __L_X_NO_RELAY exists:X-No-Relay tflags __L_X_NO_RELAY multiple meta MULTIPLE_X_NO_RELAY__L_X_NO_RELAY >= 8 describe MULTIPLE_X_NO_RELAYSaw an inordinate number of X-No-Relay: headers score MULTIPLE_X_NO_RELAY 10.0 I couldn