On Sat, 12 Feb 2005, Matt Kettler wrote:
> At 10:01 AM 2/12/2005, Theodore Heise wrote: > >When the spam in question arrived, several rules did not appear to > >fire; specifically the two RBLs RCVD_IN_BL_SPAMCOP_NET and > >RCVD_IN_XBL, as well as URIBL_OB_SURBL. > > Well, The URIBL and Spamcop changes are almost certainly due to > time difference. Those two update *VERY* fast. > > In particular, the URIBL is actually a body rule, so header > changes will not affect it. I'm confident time is the difference > here. I bet if you run it again later you'll match more of the > surbl URIBLs too. Hi Matt, Thanks for the response! Your explanation makes sense, and I really appreciate it. > The XBL however, has the "notfirsthop" restriction. It won't match > any messages that have no trusted relays. Based on the debug > output, there were no trusted relays, thus XBL would not have > matched for this reason. I think I follow this for why it didn't match on initial processing, but I still don't understand why it matched the message *after* I saved it and ran it through spamassassin -t. Ted
