> I realise that it is not an intelligent thing to block mail where the > 'To' field doesn't mention my domain name (mailinglists etc).
Actually, I've found that to be a VERY intelligent and effective thing to filter on, and I was rather surprised to find that our beloved Assassin doesn't do that by default. So I wrote my own rule to do the check (listed below). I give my rule a score of 3. It should probably be higher, but I find that's enough to tip most otherwise-stealthy spam over the threshold. This rule has never given me a false positive outside of mailing lists, and I explicitly whitelist all of the mailing lists I *want* to be subscribed to in my user.prefs. Besides, 3 isn't enough to blacklist it all by itself, and AWL usually takes care of the rest. And it hits on something like half the spam I do get. Obviously, you'll want to change the argument to something more appropriate to your own address. :-) Is there a reliable way for SpamAssassin to determine my actual user ID? If so, I think something like the following would make a useful addition to the regular install--but then, I'm just a newbie around here. :-) In EvalTests.pm, I added: sub not_to_or_cc { my ($self, $pattern) = @_; local ($_); foreach $_ ($self->{main}->find_all_addrs_in_line ($self->get ('To') . $self->get ('Cc'))) { return 0 if ($_ =~ /$pattern/i); } return 1; } And in my user_prefs: header NOT_TO_OR_CC_DANT eval:not_to_or_cc('dant') describe NOT_TO_OR_CC_DANT Not To: or Cc: me score NOT_TO_OR_CC_DANT 3.0 -- Big Dan <[EMAIL PROTECTED]> _______________________________________________________________ Don't miss the 2002 Sprint PCS Application Developer's Conference August 25-28 in Las Vegas -- http://devcon.sprintpcs.com/adp/index.cfm _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk