You were correct Andrew, I added an additional rule without the space and
started hitting them
the odd thing is that I copied and pasted that header line to my rule and when
looking at it there is a space, weird.
--
Rick
From: Colbeck, Andrew [mailto:acolb...@bentallkennedy.com]
Sent: Tuesday, September 06, 2011 5:42 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] AOL Header Test
Rick, you have a space between the colon and the YES and, if I remember
correctly, AOL does not put a space there.
#Email from AOL which they believe is spam
HEADERS 0 CONTAINS X-SPAM-FLAG:YES
On the other hand, there is a case-sensitive flavour that comes out of
SpamAssassin, and AOL provides this format at their Postmaster FAQ page for
mail that people send to AOL accounts:
#Email from a SpamAssassin implementation that belives the outbound mail was
spam
HEADERS 0 CONTAINS X-Spam-Flag: YES
http://postmaster.aol.com/Postmaster.FAQ.php
Andrew.
From: Rick Davidson [mailto:rdavid...@nat.com]
Sent: Tuesday, September 06, 2011 3:06 PM
To: Declude.JunkMail@declude.com
Subject: [Declude.JunkMail] AOL Header Test
Hello,
I have a combo test for scrutinizing AOL and the large webmail providers, I am
trying to trigger on an AOL X header with this
HEADERS 0 CONTAINS X-SPAM-FLAG: YES
any idea why this wouldn't hit?
--
Rick
CONFIDENTIALITY NOTICE
This e-mail message and any attachments contain confidential and/or privileged
information for the sole use of the intended recipient. If you are not the
intended recipient, you may not read, disseminate, distribute or copy this
e-mail message or any attachments. Please notify the sender immediately by
reply e-mail if you received this e-mail message by mistake and delete this
e-mail message and any attachments from your system. E-mail transmission cannot
be guaranteed to be secure or error-free as information could be intercepted,
corrupted, lost, destroyed, delayed, incomplete, or contain viruses. The
sender, therefore, does not accept liability for any errors or omissions in the
contents of this e-mail message or any attachments, which arise as a result of
e-mail transmission. If verification is required, please request a hard-copy
version.
-. .- -
You have received this e-mail due to a past or current transaction or as a
result of our efforts to keep you in touch with current developments affecting
your industry. If you wish to unsubscribe from any future general information
mailings, please click
heremailto:rdavid...@nat.com?subject=UNSUBSCRIBEbcc=unsubscr...@nat.com.
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe,
just send an E-mail to imail...@declude.com, and type unsubscribe
Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
This message (and any associated files) may contain confidential, proprietary
and/or privileged material and access to these materials by anyone other than
the intended recipient is unauthorized. Unauthorized recipients are required to
maintain confidentiality. Any review, retransmission, dissemination or other
use of these materials by persons or entities other than the intended recipient
is prohibited and may be unlawful. If you have received this message in error,
please notify us immediately and destroy the original.
Ce message et tout document qui y est éventuellement joint peuvent contenir de
l’information confidentielle ou exclusive. L’accès à cette information par
quiconque autre que le destinataire désigné en est donc interdit. Les personnes
ou les entités non autorisées doivent respecter la confidentialité de cette
information. La lecture, la retransmission, la communication ou toute autre
utilisation de cette information par une personne ou une entité non autorisée
est strictement interdite. Si vous avez reçu ce message par erreur, veuillez
nous en aviser immédiatement et le détruire.
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe,
just send an E-mail to imail...@declude.com, and type unsubscribe
Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
You have received this e-mail due to a past or current transaction or as a
result of our efforts to keep you in touch with current developments affecting
your industry. If you wish to unsubscribe from any future general information
mailings, please click
heremailto:rdavid...@nat.com?subject=UNSUBSCRIBEbcc=unsubscr...@nat.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to imail...@declude.com, and
type unsubscribe Declude.JunkMail. The archives can be found
at http://www.mail-archive.com.
