On Sep 28, 2015, at 10:17 PM, David B Funk <dbf...@engineering.uiowa.edu> wrote:
> By itself not a strong spam sign, but good for metas. FWIW, I added this is a rule with 0.2 points. "Unfortunately," my user's snowshoe hits today have all been hitting RDNS_NONE instead of this rule, so I can't quite gauge its effectiveness. RDNS_NONE has enough points to push these snowshoes over the threshold, which is nice... hopefully this new rule will accomplish the same. Might I recommend to KAM to include a RCVD_MAY_BE_FORGED rule with low (e.g., 0.2) points into the sandbox and test it against the corpus, to see whether it's worth keeping as a regular rule? RW recommended having this hit only on the MX server Rec'd header but I don't know if that's possible with a generic rule within SA's current framework. (e.g., is there a global variable that can hold the MX server, or list of MX servers, that can be evaluated within the RE?) Thanks. --- Amir
