I would focus on the mailfrom test, chances are the spam your client is complaining about did actually come from the country cz but definately nail it with the country test if thats what they want.
you could even add a filter like anywhere 50 contains .cz (with a space after the .cz) anywhere 50 contains .cz> Rick Davidson National Systems Manager North American Title Group - ----- Original Message ----- From: "Goran Jovanovic" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, June 09, 2004 11:01 AM Subject: [Declude.JunkMail] Blacklist one Country for one Domain Hi, I have a client who sent this to me today > Please blacklist anything that has a .cz in the address line So the way that I see doing this is a filter with the following. ALLRECIPS END NOTCONTAINS @domain.com COUNTRIES 50 CONTAINS CZ MAILFROM 50 ENDSWITH .cz My questions: Is this the best way? COUNTRIES and not COUNTRY will check every mail hop? And the biggest question will this do what the client wants? Thanx Goran Jovanovic The LAN Shoppe --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.