On Thu, 23 May 2019 19:52:41 +0200 Matus UHLAR - fantomas wrote: > >> On 22.05.19 09:34, John Hardin wrote: > >> >I'm surprised it's still present - the masscheck corpus spam/ham > >> >is > > > >> >It could probably be safely removed if there's any question about > >> >it. > > >On Thu, 23 May 2019 16:59:01 +0200 > >Matus UHLAR - fantomas wrote: > >> well, the score is still high: > >> > >> score TVD_RCVD_SINGLE 0.242 1.213 0.001 2.172 > >> > >> and it matches any helo string containing of uppercase characters > >> (and some companies still have local computers with uppercase > >> hostnames) > > On 23.05.19 16:50, RW wrote: > >FWIW that's not as bad as it sounds because that can only happen in > >the local network. > > yes, local users wondering when their mail gets evaluated as spam... > > > That situation would be very rare and it would result in > >*all* mail hitting TVD_RCVD_SINGLE which would be easy to spot. > > not all, only those who have all-uppercase hostnames. Makes > situation even worse.
The rule only matches the top received header, which is either a local hostname or the LE helo. In the former case either everything matches or nothing. Also the rule isn't just matching on an upper case hostname, it also need to be without a '.' which is not RFC compliant.
