Thanks for your patience Scott. I think I understand now, although my
actual test doesn't seem to be working. Perhaps you can tell me where I'm
going wrong?
1. I put a reference to the filter in the global.cfg file (e.g.,
c:\imail\declude\cmdspacefilter.txt x 0 0). Notice that I gave the filter
a weight of zero.
2. In the filter file, I have these lines:
LOCALCMDSPACE -
SKIPIFWEIGHT 20
TESTSFAILED END NOTCONTAINS CMDSPACE
REMOTEIP -6 CONTAINS 66.224.41
REMOTEIP -6 CONTAINS 5.75.194.49
This should name the filter LOCALCMDSPACE, should cause it to be skipped if
weight is already over 20, should cause it to quit if the TESTSFAILED text
does not contain CMDSPACE. If it gets to the last two lines, it should add
a weight of -6 if REMOTEIP contains the IP addresses. By the way, notice
that in on of the lines, I only use a partial IP address. I wanted to have
that line take effect for all IPs inside 66.224.41.*.
I didn't do anything else because I just want the weight to be adjusted.
The REMOTEIP lines restrict my weighting to those two IP addresses.
I ran an in-house test and this filter wasn't applied. I'm not sure why.
Here is a sample header from one of the tests:
Received: from bc7 [66.224.41.4] by bcw6.bcwebhost.net with ESMTP
(SMTPD32-7.15) id A5C7E3E0140; Mon, 28 Jun 2004 12:47:19 -0700
Message-ID: <[EMAIL PROTECTED]>
From: "Carol" <[EMAIL PROTECTED]>
To: "Ben Bednarz" <[EMAIL PROTECTED]>
Subject: SPAM [8]test 3
Date: Mon, 28 Jun 2004 12:47:19 -0700
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_001B_01C45D0E.0C5BBAC0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1409
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1409
X-Declude-Sender: [EMAIL PROTECTED] [66.224.41.4]
X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for
spam.
X-Spam-Tests-Failed: CMDSPACE, WEIGHT5, WEIGHT5r [8]
X-Note: This E-mail was sent from bcnetserv.bednarzconsulting.com
([66.224.41.4]).
X-RCPT-TO: <[EMAIL PROTECTED]>
Status: U
X-UIDL: 387407718
So this email failed the CMDSPACE test and came from the 66.224.41 REMOTEIP,
but didn't get the negative weight I expected from LOCALCMDSPACE.
What am I missing?
Thanks,
Ben
----- Original Message -----
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Monday, June 28, 2004 11:22 AM
Subject: Re: [Declude.JunkMail] working with filters
>
> >I must really be slow today, so my apologies in advance... Applying
actions
> >for different tests for different users/domains is fine. If I put
> >"YOURTESTNAME DELETE" into a per-domain junkmail file, then messages that
> >fail that test will be deleted.
>
> Correct (but only for E-mail to that one domain).
>
> >However, what about weighting?
>
> The weighting will be applied to all users/domains.
>
> >If I define a filter that gives a weight, then that's done at the
> >global.cfg level. I
> >can then take action at the per-domain level ("mark as spam if weight is
> >greater than 10", and so on). But it seems my filter will effect the
weight
> >of all messages.
>
> Correct.
>
> >I am trying to apply a filter that will change the weight only for a
> >specific domain. So maybe the filter runs for all domains, but I want it
to
> >only affect the weight of a certain domain.
>
> This would require some creativity, if it is possible, starting the filter
> with a line that would end the filter if the E-mail is not addressed to
the
> specific domain you want it to apply to.
>
> -Scott
> ---
> Declude JunkMail: The advanced anti-spam solution for IMail mailservers
> since 2000.
> Declude Virus: Ultra reliable virus detection and the leader in mailserver
> vulnerability detection.
> Find out what you've been missing: Ask for a free 30-day evaluation.
>
> ---
> [This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
>
> ---
> This E-mail came from the Declude.JunkMail mailing list. To
> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
> type "unsubscribe Declude.JunkMail". The archives can be found
> at http://www.mail-archive.com.
>
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
