In this last example that everyone's filter probably caught, the original email came through unflagged, but when I forwarded it to the list, the filter caught it.
Remember that failing a test and flagging (or any other action) are very different. In this case, the original question made it seem as though the E-mail wasn't failing the test, whereas it may be that the E-mail did fail the test but an action other than the one you wanted was used.
Does the X-Spam-Tests-Failed: header show the name of the filter test? If so, the E-mail is failing the test (the next step would be to determine which configuration file was used for the outgoing actions). If not, then then the E-mail did not fail the test (posting the source and the filter string would be helpful to determine what happened there -- for example, the spammer may have used 2 spaces instead of one between some words).
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers.
Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection.
Find out what you've been missing: Ask about our free 30-day evaluation.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
