Here's a rule I wrote to score two letter domains. I am not banning mail from foreign sites, I am only listing the ones that send us spam, and we do not ban the mail, merely tag it with a score. It may be a steep 3.0 out of 5.0, though. :) Also, note that I am not an "ugly american" because .us is included! :)
I recommend bringing the score down. If this is of value to more people, there could be a general rule including all the country codes, sorted by statistics of spam so that it would be something like FROM_SPAM_DOM_80-90 where the domain is in the top 80-90%. Something like that, you get the idea. I have heard all the arguments against this rule. Suffice it to say that you can add it or don't at your leisure. One person's spam is another's ham. header FROM_FOREIGN_DOM From =~ /[EMAIL PROTECTED](?:at|au|be|br|ca|cc|ch|cl|cn|cz|de|dk|fr|fi|il|it|jp|kr|lv|mn|nl|no|nz|pl|ro|ru|se|tr|tw|tv|uk|us|za)\>/i describe FROM_FOREIGN_DOM Domain is two-letter foreign address score FROM_FOREIGN_DOM 3.0 A more brutal rule might be [EMAIL PROTECTED]> :) ------------------------------------------------------- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01 _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
