Tim Macrina wrote:
Can anyone explain to me what the difference is between rawbody and
body when writing spamassassin rules.
Theo, etc explained the difference between rawbody and body quite well. I won't
re-iterate that.
> I am currently using body for
> most of my body rules but I did find one that was not working. I was
> looking for a specific html tag and it did not work but when I changed
> it to rawbody it worked. can I/should I change all my rules to use
> rawbody.
Theo also answered this, but I wanted to clarify a bit:
No you should not change all your rules to rawbody. They'll appear to work if
you change them to rawbody, but any HTML tag insertion obfuscations will prevent
your rules from matching their desired text. That's not a good thing as it's a
popular trick for spammers. Things like: "VIAG<!-- hello -->RA" will not bother
a body rule, but a rawbody rule will be tricked by the insertion.
Only use rawbody when you want to examine HTML tags or line-break placement.
Body is for general-purpose body text checks.
full is best left for advanced tricks (qp encoding checks, etc.)
