Le 29/01/2011 14:39, Noel Jones a écrit :
> On 1/28/2011 4:29 PM, Jerrale G wrote:
>> Here is what I have tried so far:
>>
>> /(^X-Spam-Status:\sYes,\sscore=\d\d(\.\d)?\s)/gi
>> DISCARD High Potential for Spam
>
> That's overly complicated.
>
> /^X-Spam-Status: Yes/ DISCARD High Spam Score
>
> will do the same thing.
>
you missed his \d\d. He only wants to discard if the score contains two
digits. something like
/^X-Spam-Status: Yes, score=\d{2}/ DISCARD blah blah
but even then, this is risky. from time to time, some rules get wrong
(remember the recent "date in the future" issue...) or a local config
may look good for long then starts hitting ham. In such cases, the score
may get high (more than 10). it would be bad to discard mail in this
case. a quarantine (per user or site-wide if there are no privacy
issues) is probably wiser. so instead of DISCARD, OP can use FILTER and
pass such mail to a postfix instance that delivers to a dedicated
mailstore that can be purged periodically (alternatively: REDIRECT).
This way, if an FP is suspected, one can search that mailbox and
resubmit the message.
>
>>
>> Even withn the Discard, does it reflect its action in the log?
>> I think it is required of me to have these logged.
>
> The discard action is logged with the client, the sender and the current
> recipient. With multi-recipient mail, only one recipient is logged.
>
> -- Noel Jones
