I use a subject rule here at work (procmail filters at home). I just changed it to a header rule, and it looks like capitalization counts.
X-Spam-Flag: Yes didn't work, but X-Spam-Flag: YES did. The header it triggered on matched that exactly. I don't know if you can use wildcards in Outlook rules or not. Here's the headers from my test spam, with the domain names changed to protect the innocent... Received: via tmail-4.1(12) for myid; Thu, 26 Sep 2002 17:02:18 -0700 (PDT) Return-Path: <[EMAIL PROTECTED]> Received: from mx1.mywork.tld (mx1.mywork.tld [10.0.0.1]) by mailhost.mywork.tld (8.12.3/8.12.3) with ESMTP id g8R02Fba006468 for <[EMAIL PROTECTED]>; Thu, 26 Sep 2002 17:02:15 -0700 Received: from example.com (some.host.name [192.168.1.34]) by mx1.mywork.tld (8.11.6/8.11.6) with ESMTP id g8R029J31387 for <[EMAIL PROTECTED]>; Thu, 26 Sep 2002 17:02:09 -0700 Received: from example.com (example.com [127.0.0.1] (may be forged)) by example.com (8.12.3/8.12.3) with ESMTP id g8R02CYA011465 for <[EMAIL PROTECTED]>; Thu, 26 Sep 2002 17:02:12 -0700 Received: (from myid@localhost) by example.com (8.12.3/8.12.3/Submit) id g8R02CR4011463; Thu, 26 Sep 2002 17:02:12 -0700 Date: Sun, 15 Sep 2002 23:57:42 -0700 Reply-To: <[EMAIL PROTECTED]> Message-ID: <007b56e86cda$2742b1b4$1ac04db8@hwnuvr> From: <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: ***SPAM*** FORTUNE 500 WORK AT HOME REPS NEEDED! MiME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook, Build 10.0.2627 Importance: Normal Status: O Lines: 26 X-Virus-Scanned: by amavisd-milter (http://amavis.org/) X-Virus-Scanned: by amavisd-milter (http://amavis.org/) X-Spam-Status: Yes, hits=22.6 required=5.0 tests=MIME_ODD_CASE,MAY_BE_FORGED,NO_REAL_NAME,FROM_ENDS_IN_NUMS, PLING,WORK_AT_HOME,NO_EXPERIENCE,CLICK_BELOW,EXCUSE_3, WEIRD_PORT,REMOVE_PAGE,FREQ_SPAM_PHRASE,SUBJ_ALL_CAPS, DATE_IN_PAST_96_XX version=2.31 X-Spam-Flag: YES X-Spam-Level: ********************** X-Spam-Checker-Version: SpamAssassin 2.31 (devel $Id: SpamAssassin.pm,v 1.94.2.2 2002/06/20 17:20:29 hughescr Exp $) X-Spam-Report: 22.6 hits, 5 required; * 4.3 -- MiME-Version header (oddly capitalized) * 1.6 -- 'Received:' has 'may be forged' warning * 0.5 -- From: does not include a real name * 0.4 -- From: ends in numbers * 0.1 -- Subject has an exclamation mark * 3.2 -- BODY: Information on how to work at home (1) * 4.2 -- BODY: No experience needed! * 1.5 -- BODY: Asks you to click below * 1.1 -- BODY: Claims you can be removed from the list * 0.3 -- URI: Uses non-standard port number for HTTP * 2.2 -- URI: URL of page called "remove" * 2.4 -- Contains phrases frequently found in spam [score: 14, hits: fill out, from home, from our,] [looking for, one our, our list, removed from,] [that will, that you, who are, you] [with] * -0.1 -- Subject is all capitals * 0.9 -- Date: is 96 hours or more before Received: date | -----Original Message----- | From: Jay Strickland [mailto:[EMAIL PROTECTED]] | Sent: Thursday, September 26, 2002 4:55 PM | To: 'Steve Thomas'; [EMAIL PROTECTED] | Subject: RE: [SAtalk] Outlook Configuration | | | I know how to do that, but I'm having a hard time figuring out | what to tell outlook to look for in terms of a header flag. I've | tried | | X-Spam-Flag | Spam-Flag | Spam Flag | X Spam Flag | | All setup as a Yes/No field. None of these appears to adequately | work. | | Thanks, | Jay | | -- | Jay Strickland, [EMAIL PROTECTED] | President, WingSwept Communications, Inc. | President, WingSwept Technologies, Inc. | www.wingswept.com | Phone: 919.779.0954 | | -----Original Message----- | From: Steve Thomas [mailto:[EMAIL PROTECTED]] | Sent: Thursday, September 26, 2002 7:37 PM | To: [EMAIL PROTECTED]; [EMAIL PROTECTED] | Subject: RE: [SAtalk] Outlook Configuration | | | Create a folder in Outlook where you want to place tagged messages. Then | click on Tools/Rules Wizard and follow the instructions there to create | a | filter that will move messages with your subject line tag or header flag | into the folder you created. | | HTH, | St- | | | | -----Original Message----- | | From: [EMAIL PROTECTED] | | [mailto:[EMAIL PROTECTED]]On Behalf Of Jay | | Strickland | | Sent: Thursday, September 26, 2002 3:25 PM | | To: [EMAIL PROTECTED] | | Subject: [SAtalk] Outlook Configuration | | | | | | I've gotten SA configured on my server to scan messages | | server-wide w/ exim. The headers are going into the messages | | but I'm having a hard time figuring out the "easy" part which | | is how Outlook can flag those messages for me. I've tried | | putting in a custom field for X-Spam-Flag, but don't appear | | to be getting anywhere. Please respond back to this address | | as I'm not a member of the list. | | | | Thanks, | | Jay | | | | -- | | Jay Strickland, [EMAIL PROTECTED] | | President, WingSwept Communications, Inc. | | President, WingSwept Technologies, Inc. | | www.wingswept.com | Phone: 919.779.0954 | | | | | | | | ------------------------------------------------------- | | This sf.net email is sponsored by:ThinkGeek | | Welcome to geek heaven. | | http://thinkgeek.com/sf | | _______________________________________________ | | Spamassassin-talk mailing list | | [EMAIL PROTECTED] | | https://lists.sourceforge.net/lists/listinfo/spamassassin-talk | | | | ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk