On Fri, 31 Aug 2018, John Hardin wrote:
None of the masscheck corpora that hit __HDR_ORDER_FTSDMCXXXX also
hit ALL_TRUSTED (or at least the portion is so small it falls off
the bottom of the report) so I don't feel too worried about adding
either !ALL_TRUSTED or __ANY_EXTERNAL (or potentially both) as
exclusions.
I'm adding __ANY_EXTERNAL now...
Comments solicited.
On 31.08.18 16:16, John Hardin wrote:
Here's one: should __ANY_EXTERNAL be added to any other rules that
primarily look for abused MSFT-isms?
For example, MIMEOLE_DIRECT_TO_MX, DOS_OE_TO_MX, DOS_OUTLOOK_TO_MX,
XPRIO_SHORT_SUBJ, ...?
Now that you pulled this out...
Yes, it would also help on some servers I maintain (where HDR_ORDER_FTSDMCXX*
caused troubles).
The question I still have is, if this is not in contrast with proposed usage
of __ANY_EXTERNAL or !ALL_TRUSTED
--
Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
If Barbie is so popular, why do you have to buy her friends?
