I received a copy of the "Single European Girls" message at work, where I'm using a different spam filter, which caught it giving this reasoning:
X-Reject: Forged From: header slandering juno.com X-Warning: From:/Message-Id: is local, but message is external The procmail recipe for "slandering juno.com" is: * 3^0 ^From:.*@juno\.com * -1^0 ^Received:.from.*mail\.com.*\[[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\].*by * -1^0 ^X-Mailer: mail\.com * -1^0 ^X-Originating-IP: [0-9]+\.[0-9]+\.[0-9]+\.[0-9]+ That is, all real juno messages will have X-Mailer and X-Originating-IP headers as shown, and will be routed through mail.com. Perhaps this could be translated into a SpamAssassin eval test; I can't think of any way to write it as a regex test. The procmail recipe for "local but message is external" requires that the configuration know what set of domains should be considered "local" (it may not be just the local machine, if e.g. the mail is delivered to an ISP mailbox and then downloaded with fetchmail) so that's more difficult to translate. _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
