On Sep 29, 2015, at 10:44 AM, John Hardin <jhar...@impsec.org> wrote:
> On Tue, 29 Sep 2015, Philip Prindeville wrote: > >> Can you use something like: >> >> header __L_X_NO_RELAY exists:X-No-Relay > > Are you seeing empty X-No-Relay headers? How about: No, not empty. Typically they say: X-No-Relay: not in my network > > header __HAS_NO_RELAY X-No-Relay =~ /./ > > ...which is in my sandbox, but just for eval, it's not scored yet: No, that ends up matching once per character… But /.*/ works. > > http://ruleqa.spamassassin.org/20150926-r1705400-n/__HAS_NO_RELAY/detail > >> tflags __L_X_NO_RELAY multiple >> >> meta MULTIPLE_X_NO_RELAY __L_X_NO_RELAY >= 8 > > If you're doing that, do TFLAGS multiple, maxhits=9 > > I'll add this to my sandbox. > > -- > John Hardin KA7OHZ http://www.impsec.org/~jhardin/ > jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org > key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
