David G. Andersen wrote:
>Note that whitelisting from 'root' is probably a bad idea:
>
>593 eep:spam/raw> grep -i "^From: .*root" * | wc
> 19 56 841
>
>weekly run output, however, is far safer:
>
>595 eep:spam/raw> grep -i 'weekly run' * | wc
> 0 0 0
>
> -Dave
>
Concur. I proposed a positive score change
header TO_ADMIN_ACCT To =~ /(?:webmaster|root|postmaster)\@/
describe TO_ADMIN_ACCT Sent to an administrative account aliased to me
score TO_ADMIN_ACCT 1.5
that seemed to meet with a collective "maybe-well-no", but traps a *lot*
of spam for me. What you really want is an "and" condition that's
unlikely to be met by spam -- the "Charlie Root" test is one of them,
and chances are, your cron messages are also coming from root or nobody
or whomsoever. Your options are
1) Pick up the current CVS tree and set up a short-circuit rule that
allows multiple tests.
2) Use ~/.procmailrc to do a multipart test and skip SpamAssassin testing.
3) Something else 'cause you're not using procmail.
--
http://www.pricegrabber.com | Dog is my co-pilot.
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
