Hello Sylvain,
Wednesday, January 21, 2004, 7:54:09 AM, you wrote:
SR> On Wed, 21 Jan 2004, Christian Nygaard wrote:
SR> A friend of mine also has suggested the following (the coding is my own,
SR> so if it doesn't work, I've poorly implemented the suggestion):
SR> header SYL_BAD_XOIP X-Originating-IP !~ /\[?(\d{1,3}\.){3}\d{1,3}\]?/
SR> describe SYL_BAD_XOIP Improperly formatted X-Originating-IP header
SR> score SYL_BAD_XOIP 4.0 # frankly, this alone should be grounds
SR> # for rejection ...
SR> NOTE: I've not yet tested this rule, but so far in the mail I have, it
SR> would match only on spam ...
Results against my corpus:
SYL_BAD_XOIP -- 73662s/14971h of 91714 corpus (74113s/17601h) 01/21/04
That's almost 15k ham matched, out of 17.6k ham in my corpus.
I suspect the problem is that since you're saying X-Originating-IP must
NOT be the regex, emails with no X-Originating-IP are also matching.
Add a test for UNSET (no such tag), and you should be able to improve
these results.
Bob Menschel
-------------------------------------------------------
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
http://www.eclipsecon.org/osdn
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
