One potential new check would be for "Received:" sequences. E.G. that there's no message with a "Received: from XXX by YYY" followed by "Received: from WWW by ZZZ". If ZZZ received the message, then ZZZ should have sent it on the next hop ( or atleast something with the same IP address as ZZZ). This isn't 100%, but I know that many spammers have fake "Received:" lines that aren't always preceeded by a "Subject:" line so it wouldn't trigger the current check for bogus "Received:" lines. I'm sure this would have to be an external check. Don
-- -------------------------------------------------------- Donald L. Greer, Jr [EMAIL PROTECTED] System Administrator Voice: 512-300-0176 AustinTX http://www.AustinTX.COM/ All opinions are my own. Flame me directly. "I don't necessarily believe software should be free... but if you pay for it, it should work!" -- Me _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
