Wouldn't this provide an easy way for spammers to get around your filters?
I've seen spam come in with headers looking as if it'd already been scanned
(albeit somewhere else). Anyways, that's just my 2 cents.
~J.C.
> -----Original Message-----
> From: Owen McShane [mailto:[EMAIL PROTECTED]
> [EMAIL PROTECTED] said:
> > No, but if you use procmail to call SA you can modify
> your procmailrc to
> > skip calling SA for messages with x-Spam-Status set to Yes.
>
> > Be sure to avoid skipping emails with X-Spam-Status:
> No, as those emails are
> > likely to be forgeries and it provides a way around SA.
>
> > The other alternative is to customize their header
> name on one or both
> > systems, and use X-JoesISP-Spam-Status: instead of
> X-Spam-Status:
>
> I would avoid doing any filtering based on X-Spam-Status at all.
>
> Had a colleague who was filtering on the "X-Spam-Status"
> header containing "yes".
>
> Not surprisingly, headers such as this were matching:
>
> X-spam-status: No, hits=0.1 required=5.0
> tests=BAYES_50,HTML_MESSAGE
>
> Use X-spam-flag instead (just if it exists, forget any content).
>
> Owen
>
> --
> Via Net.Works UK Ltd
> Local Touch Global Reach
> Owen McShane Systems Administrator
> http://www.vianetworks.co.uk Tel +44 (0)1925 484444
>
