I have seen a COUNTRY test mentioned on the list. It references the %countrychain% variable.
How is this test implemented? What does it do? How do I get the countrychain variable to appear in the header (mine appears blank).
The first thing you have to do is download the database from http://www.declude.com/release/175/all_list.dat . This needs to go in your \IMail\Declude directory. Then, the %COUNTRYCHAIN% variable and the country filtering will be enabled. For filtering, you can use the formats:
COUNTRY CONTAINS 5 cn
COUNTRIES CONTAINS 5 kr"COUNTRY" will only match when the remote mailserver is in the listed country (in the example above, it would match if the remote mailserver was in China, but not if a spammer in China relayed the mail through Spain). "COUNTRIES" will match when the E-mail traveled through the listed country (in the second example, an E-mail would get caught whether it was sent from a mailserver in China, or whether a mailserver in China relayed it through another country).
Note that this is an experimental feature in Declude JunkMail Pro, and since new IPs are allocated daily, it will require occasional updating of the IP/country data (the all_list.dat file).
The filter uses the 2-character country code, which is the same as the 2-character ccTLDs ("[EMAIL PROTECTED]"). A list of these codes can be found at http://www.iana.org/cctld/cctld-whois.htm .
Besides countries, the following may be used as well, in cases where the country is not known:
*1 Multi-Regional
*2 Europe
*3 North America
*4 Central/South America
*5 Pacific Rim
*A ARIN Unlisted
*B Public Data Network
*E RIPE Unlisted
*I Private IP
*L Loopback
*M Multicast
*P APNIC Unlisted
*R IANA Reserved
*U Unknown-Scott
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
