Theo Van Dinter wrote: >> Well, for a start, normally the X-Spam-* stuff gets inserted at the very >> >>end of the header block, but what I'm seeing instead is: >> >> > >You're running 3.1 which puts them at the top of the headers. It was in the >3.1.0 release announcement: > >- modify header ordering for DomainKeys compatibility, by placing markup > headers at the top of the message instead at the bottom of the list. > >
# spamassassin --version SpamAssassin version 3.1.1 running on Perl version 5.8.5 # things would be a little clearer if there was a consistent place that the X-Spam-*: stuff got inserted at... It seems to move around. >>From: [EMAIL PROTECTED] >> >>I'm also not seeing the rule: >>header L_EBAY_PHISH From =~ /[EMAIL >>PROTECTED](paypal|ebay|chase)\.com>/i >> >> > >Of course not, that pattern doesn't match the From header. > > Ok, so I changed the pattern to be >? instead... And it matched... Doesn't RFC-822 require that the addresses be bracketed? Or is that only when a comment string is present? And how often does one actually see an address that isn't bracketed? Could that be used to add some delta to the score that makes an email more suspect? -Philip
