> > Wondering about this detection: > > > > "2.4 RDNS_NONE Delivered to internal network by a host with no > > rDNS"
I saw this sometimes in mails delivered from external where people have sent their mail within an internal lan to for example the companies (internal reachable) mailserver. This rule seems to have excluded such cases, means not match when mail is send in cases like 192.168.0.0/16. Sorry, I have no example, have to look until I see this again..