RE: [Declude.JunkMail] AOL Header Test

2011-09-08 Thread Rick Davidson 
You were correct Andrew, I added an additional rule without the space and 
started hitting them

the odd thing is that I copied and pasted that header line to my rule and when 
looking at it there is a space, weird.

--
Rick

From: Colbeck, Andrew [mailto:acolb...@bentallkennedy.com]
Sent: Tuesday, September 06, 2011 5:42 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] AOL Header Test

Rick, you have a space between the colon and the YES and, if I remember 
correctly, AOL does not put a space there.

#Email from AOL which they believe is spam
HEADERS   0 CONTAINS X-SPAM-FLAG:YES
On the other hand, there is a case-sensitive flavour that comes out of 
SpamAssassin, and AOL provides this format at their Postmaster FAQ page for 
mail that people send to AOL accounts:

#Email from a SpamAssassin implementation that belives the outbound mail was 
spam
HEADERS   0 CONTAINS X-Spam-Flag: YES

http://postmaster.aol.com/Postmaster.FAQ.php


Andrew.


From: Rick Davidson [mailto:rdavid...@nat.com]
Sent: Tuesday, September 06, 2011 3:06 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] AOL Header Test
Hello,
I have a combo test for scrutinizing AOL and the large webmail providers, I am 
trying to trigger on an AOL X header with this

HEADERS 0 CONTAINS X-SPAM-FLAG: YES

any idea why this wouldn't hit?

--
Rick


CONFIDENTIALITY NOTICE

This e-mail message and any attachments contain confidential and/or privileged 
information for the sole use of the intended recipient. If you are not the 
intended recipient, you may not read, disseminate, distribute or copy this 
e-mail message or any attachments. Please notify the sender immediately by 
reply e-mail if you received this e-mail message by mistake and delete this 
e-mail message and any attachments from your system. E-mail transmission cannot 
be guaranteed to be secure or error-free as information could be intercepted, 
corrupted, lost, destroyed, delayed, incomplete, or contain viruses. The 
sender, therefore, does not accept liability for any errors or omissions in the 
contents of this e-mail message or any attachments, which arise as a result of 
e-mail transmission. If verification is required, please request a hard-copy 
version.

-. .- -


You have received this e-mail due to a past or current transaction or as a 
result of our efforts to keep you in touch with current developments affecting 
your industry. If you wish to unsubscribe from any future general information 
mailings, please click 
here<mailto:rdavid...@nat.com?subject=UNSUBSCRIBE&bcc=unsubscr...@nat.com>.
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.

This message (and any associated files) may contain confidential, proprietary 
and/or privileged material and access to these materials by anyone other than 
the intended recipient is unauthorized. Unauthorized recipients are required to 
maintain confidentiality. Any review, retransmission, dissemination or other 
use of these materials by persons or entities other than the intended recipient 
is prohibited and may be unlawful. If you have received this message in error, 
please notify us immediately and destroy the original.

Ce message et tout document qui y est éventuellement joint peuvent contenir de 
l’information confidentielle ou exclusive. L’accès à cette information par 
quiconque autre que le destinataire désigné en est donc interdit. Les personnes 
ou les entités non autorisées doivent respecter la confidentialité de cette 
information. La lecture, la retransmission, la communication ou toute autre 
utilisation de cette information par une personne ou une entité non autorisée 
est strictement interdite. Si vous avez reçu ce message par erreur, veuillez 
nous en aviser immédiatement et le détruire.

--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, 
just send an E-mail to imail...@declude.com, and type "unsubscribe 
Declude.JunkMail". The archives can be found at http://www.mail-archive.com.


You have received this e-mail due to a past or current transaction or as a 
result of our efforts to keep you in touch with current developments affecting 
your industry. If you wish to unsubscribe from any future general information 
mailings, please click 
here<mailto:rdavid...@nat.com?subject=UNSUBSCRIBE&bcc=unsubscr...@nat.com>.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

RE: [Declude.JunkMail] AOL Header Test

2011-09-06 Thread Colbeck, Andrew 
Rick, you have a space between the colon and the YES and, if I remember
correctly, AOL does not put a space there.

#Email from AOL which they believe is spam
HEADERS   0 CONTAINS X-SPAM-FLAG:YES

On the other hand, there is a case-sensitive flavour that comes out of
SpamAssassin, and AOL provides this format at their Postmaster FAQ page
for mail that people send to AOL accounts:

#Email from a SpamAssassin implementation that belives the outbound mail
was spam
HEADERS   0 CONTAINS X-Spam-Flag: YES

http://postmaster.aol.com/Postmaster.FAQ.php


Andrew.



From: Rick Davidson [mailto:rdavid...@nat.com]
Sent: Tuesday, September 06, 2011 3:06 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] AOL Header Test



Hello,

I have a combo test for scrutinizing AOL and the large webmail
providers, I am trying to trigger on an AOL X header with this



HEADERS 0 CONTAINS X-SPAM-FLAG: YES



any idea why this wouldn't hit?



--

Rick




CONFIDENTIALITY NOTICE

This e-mail message and any attachments contain confidential and/or
privileged information for the sole use of the intended recipient. If
you are not the intended recipient, you may not read, disseminate,
distribute or copy this e-mail message or any attachments. Please notify
the sender immediately by reply e-mail if you received this e-mail
message by mistake and delete this e-mail message and any attachments
from your system. E-mail transmission cannot be guaranteed to be secure
or error-free as information could be intercepted, corrupted, lost,
destroyed, delayed, incomplete, or contain viruses. The sender,
therefore, does not accept liability for any errors or omissions in the
contents of this e-mail message or any attachments, which arise as a
result of e-mail transmission. If verification is required, please
request a hard-copy version.

-. .- -


You have received this e-mail due to a past or current transaction or as
a result of our efforts to keep you in touch with current developments
affecting your industry. If you wish to unsubscribe from any future
general information mailings, please click here
<mailto:rdavid...@nat.com?subject=UNSUBSCRIBE&bcc=unsubscr...@nat.com> .

--- This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to imail...@declude.com, and type
"unsubscribe Declude.JunkMail". The archives can be found at
http://www.mail-archive.com.


This message (and any associated files) may contain confidential, proprietary 
and/or privileged material and access to these materials by anyone other than 
the intended recipient is unauthorized. Unauthorized recipients are required to 
maintain confidentiality. Any review, retransmission, dissemination or other 
use of these materials by persons or entities other than the intended recipient 
is prohibited and may be unlawful. If you have received this message in error, 
please notify us immediately and destroy the original.


Ce message et tout document qui y est eventuellement joint peuvent contenir de 
l'information confidentielle ou exclusive. L'acces a cette information par 
quiconque autre que le destinataire designe en est donc interdit. Les personnes 
ou les entites non autorisees doivent respecter la confidentialite de cette 
information. La lecture, la retransmission, la communication ou toute autre 
utilisation de cette information par une personne ou une entite non autorisee 
est strictement interdite. Si vous avez recu ce message par erreur, veuillez 
nous en aviser immediatement et le detruire.


---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

[Declude.JunkMail] AOL Header Test

2011-09-06 Thread Rick Davidson 
Hello,
I have a combo test for scrutinizing AOL and the large webmail providers, I am 
trying to trigger on an AOL X header with this

HEADERS 0 CONTAINS X-SPAM-FLAG: YES

any idea why this wouldn't hit?

--
Rick


CONFIDENTIALITY NOTICE

This e-mail message and any attachments contain confidential and/or privileged 
information for the sole use of the intended recipient. If you are not the 
intended recipient, you may not read, disseminate, distribute or copy this 
e-mail message or any attachments. Please notify the sender immediately by 
reply e-mail if you received this e-mail message by mistake and delete this 
e-mail message and any attachments from your system. E-mail transmission cannot 
be guaranteed to be secure or error-free as information could be intercepted, 
corrupted, lost, destroyed, delayed, incomplete, or contain viruses. The 
sender, therefore, does not accept liability for any errors or omissions in the 
contents of this e-mail message or any attachments, which arise as a result of 
e-mail transmission. If verification is required, please request a hard-copy 
version.

-. .- -


You have received this e-mail due to a past or current transaction or as a 
result of our efforts to keep you in touch with current developments affecting 
your industry. If you wish to unsubscribe from any future general information 
mailings, please click 
here.

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to imail...@declude.com, and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.