Hi, I received such a legitimate mail:

Received: from GTEW2KPR07 by marketing.grouppoint.at
        (MDaemon.Standard.v7.2.2.R)
        with ESMTP id pd50000008044.msg
        for <[EMAIL PROTECTED]>; Fri, 07 Apr 2006 11:26:25 +0200
Message-ID: 
<[EMAIL PROTECTED]>
From: "GROUP POINT News" <[EMAIL PROTECTED]>
To: "GROUP POINT News" <[EMAIL PROTECTED]>
Subject: Server Angebot April 2006
Date: Fri, 7 Apr 2006 11:25:16 +0200
MIME-Version: 1.0
Content-Type: multipart/related;
  type="multipart/alternative";
  boundary="----=_NextPart_000_0045_01C65A35.F1EF82D0"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1506
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1506
X-Authenticated-Sender: [EMAIL PROTECTED]
X-MDRemoteIP: 10.1.1.101
Sender: [EMAIL PROTECTED]
X-Return-Path: [EMAIL PROTECTED]
X-MDMailing-List: [EMAIL PROTECTED]
X-MDSend-Notifications-To: [EMAIL PROTECTED]
Reply-To: [EMAIL PROTECTED]
X-MDaemon-Deliver-To: [EMAIL PROTECTED]
X-Virus-Scanned: amavisd-new at goelsen.net
X-Virus-Scanned: amavisd-new at zmi.at
X-Spam-Status: Yes, hits=5.724 tagged_above=-999 required=5 
tests=AWL=-0.275,
 DNS_FROM_RFC_POST=1.44, EXTRA_MPART_TYPE=0.815, 
FORGED_MUA_OUTLOOK=3.36,
 HTML_FONT_BIG=0.256, HTML_MESSAGE=0.001, HTML_TAG_EXIST_TBODY=0.126,
 UNPARSEABLE_RELAY=0.001
X-Spam-Level: *****
X-Spam-Flag: YES

I believe it hits FORGED_MUA_OUTLOOK because MDAEMON modifies the 
Message-ID. So there should be a rule allowing MDAEMON like

header __OE_MSGID_4     MESSAGEID =~ /^<[EMAIL PROTECTED]>$/m

Any other ideas?

mfg zmi
-- 
// Michael Monnerie, Ing.BSc    -----      http://it-management.at
// Tel: 0660/4156531                          .network.your.ideas.
// PGP Key:   "lynx -source http://zmi.at/zmi3.asc | gpg --import"
// Fingerprint: 44A3 C1EC B71E C71A B4C2  9AA6 C818 847C 55CB A4EE
// Keyserver: www.keyserver.net                 Key-ID: 0x55CBA4EE

Attachment: pgpgd9mZxMKOh.pgp
Description: PGP signature

Reply via email to