Scott, OK. I'll leave you alone for the rest of today <G>.
BTW, HiJack has trapped over 500 pieces of SPAM this weekend for 2 domains whose Primary MX's have been up and running the entire time. JunkMail got another 400+ for 1 of those domains. Just shows how the spammers are going after the secondary MX's. George -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of R. Scott Perry Sent: Sunday, February 02, 2003 11:59 AM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] Filter Question >I would like to be able to filter on the domain names of mailservers in >the chain. In this case I would like to have an entry such as > >WHATEVER CONTAINS .aebolts.com (Where WHATEVER is a valid filter >screening criteria for the mailservers in the chain). I know I can use >HEADER for this but is there a parameter I've missed that would let me >have these checked as JunkMail is parsing to do its thing on each of >the hops. I have HOPHIGH 6 in my GLOBAL.CFG. No, there isn't any other parameter aside from HEADERS that you could filter on in this case. Although Declude JunkMail does look at the server names, the only one it cares about is one corresponding to the remote mailserver (the HELO parameter in filtering). In this case, I would recommend using something like: HEADERS 5 CONTAINS .aebolts.com ( Adding the "(" there should prevent virtually all other headers from triggering the filter (for example, you could have "Subject: We have to do something about these .aebolts.com E-mails!" that wouldn't get caught). It's not quite as accurate as it would be if there was a parameter that just searched the server names, but it's pretty close. -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
