Hi Scott, Nothing like a quiet Sunday morning to get the questions going.
I have a filter question and will use the following header to explain. The e-mail is being handled correctly by JunkMail according to the GLOBAL.CFG settings I would like to be able to filter on the domain names of mailservers in the chain. In this case I would like to have an entry such as WHATEVER CONTAINS .aebolts.com (Where WHATEVER is a valid filter screening criteria for the mailservers in the chain). I know I can use HEADER for this but is there a parameter I've missed that would let me have these checked as JunkMail is parsing to do its thing on each of the hops. I have HOPHIGH 6 in my GLOBAL.CFG. I realize that this particular piece of SPAM has been identified as such by many other tests, but that's not the question here. As always, thanks for the time. George Kulman Partner Ridge Systems, L.L.C. Example Header follows: *************************************************** Received: from mtiwmhc14.worldnet.att.net [204.127.131.114] by mail.ridge-systems.com with ESMTP (SMTPD32-7.13) id A1E0250252; Sun, 02 Feb 2003 09:57:36 -0500 Received: from mtiwmhc14.worldnet.att.net ([127.0.0.1]) by mtiwmhc14.worldnet.att.net (InterMail vM.5.01.05.12 201-253-122-126-112-20020820) with ESMTP id <[EMAIL PROTECTED] net> for <[EMAIL PROTECTED]>; Sun, 2 Feb 2003 14:56:07 +0000 Received: from data.aebolts.com ([216.171.211.31]) by mtiwmhc14.worldnet.att.net (mtiwmhc14) with ESMTP id <2003020214560611400kmvlje>; Sun, 2 Feb 2003 14:56:06 +0000 Received: from data.aebolts.com (data.aebolts.com [216.171.211.31] (may be forged)) by data.aebolts.com (8.12.6/8.12.6) with ESMTP id h12FSook018111 for <[EMAIL PROTECTED]>; Sun, 2 Feb 2003 07:28:50 -0800 Received: (from root@localhost) by data.aebolts.com (8.12.6/8.12.6/Submit) id h12FSo64018109; Sun, 2 Feb 2003 07:28:50 -0800 Message-Id: <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Reply-To: <[EMAIL PROTECTED]> From: "Rick Wagner" <[EMAIL PROTECTED]> Subject: Date: Sun Feb 2 01:05:00 PST 2003 MIME-Version: 1.0 Content-Type: text/html; Content-Transfer-Encoding: 7bit X-RBL-Warning: SPAMCOP: Blocked - see http://spamcop.net/bl.shtml?216.171.211.31 X-RBL-Warning: BADHEADERS: This E-mail was sent from a broken mail client [8010000e]. X-Declude-Sender: [EMAIL PROTECTED] [127.0.0.1] X-Declude-Spoolname: D31e0002502523542.SMD X-Spam-Tests-Failed: 15 SPAMCOP, BADHEADERS, IPNOTINMX, WEIGHT10 X-Note: This E-mail was sent from (Private IP) ([127.0.0.1]). X-Country-Chain: UNITED STATES->destination X-ALLRECIPS: [EMAIL PROTECTED] X-RCPT-TO: <[EMAIL PROTECTED]> Status: U X-UIDL: 341851603 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.