Alex wrote on Mon, 11 Jan 2010 12:38:29 -0500: > Just to clarify, you're referring to this, right: > > Received: from mx.sourceforge.net by mailsrv1.trimble.co.nz > (envelope-from <f...@ef- > > How would add the rule you are suggesting? It would be specific to > sourceforge.net, and have a table where its authoritative IP and MX > are stored, right?
I would rather look for To: *...@users.sourceforge.net and score if the From is not from sourceforge.net (meta-rule). This indicates that it is an external mail that was sent to an SF users alias. I've personally not ever gotten a legitimate mail to this alias from outside of SF (and I think SF admin/dev/news mail uses the target address directly, anyway, and not the alias). So, depending on what you get over this route you may either score or drop completely. Kai -- Get your web at Conactive Internet Services: http://www.conactive.com
