> -----Original Message----- > From: John Rudd > Shouldn't that last bit be: > > [12456789]\d$/ > > > As you've got it, it will reject an offset of xx30, which, as > you pointed out, is valid.
Actually, the vast majority would be caught with [2468]0$/ I've quarantined thousands of these since I put the rule in on Tuesday. Only about 10 have been xx30, the rest would have been caught by this modification. Also, I don't add enough points to block based on this rule alone. The Received rule, yes. This one is just sort of a placeholder so I can investigate if I start seeing a bunch that match on the Date rule but no longer match on the forged Received rule. _______________________________________________ NOTE: If there is a disclaimer or other legal boilerplate in the above message, it is NULL AND VOID. You may ignore it. Visit http://www.mimedefang.org and http://www.roaringpenguin.com MIMEDefang mailing list MIMEDefang@lists.roaringpenguin.com http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
