Recently had some false negatives come through.  Most of them are one sentence
saying hello, and a URL.  I noticed some strange headers, listed here:

X-E:
X-I:
X-ENVID
X-Email

So I wrote a quickie rule and it catches about 126 spam per week.

header BAD_HEADERS              ALL =~ /X-(?:E|Email|ENVID|I):/
describe BAD_HEADERS            Header uses spammy X- header
score BAD_HEADERS               3.0

Is X-ENVID a potential false-positive?  I haven't seen any "legitimate" use
for it.


-------------------------------------------------------
This SF.net email is sponsored by OSDN developer relations
Here's your chance to show off your extensive product knowledge
We want to know what you know. Tell us and you have a chance to win $100
http://www.zoomerang.com/survey.zgi?HRPT1X3RYQNC5V4MLNSV3E54
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk

Reply via email to