RE: Scoring PTR's

[Robert Swan]

Title: RE: Scoring PTR's

That is what I thought but the :EvalTests modules are not documented. Then I thought maybe a rule that compares the two names on the “Received:” line because the PTR always falls after the “(“ and before the “[“. Also, The broadcast name always comes after “Received: from”   Robert             Peace he would say instead of goodbye....peace my brother. From: Chris Santerre [mailto:[EMAIL PROTECTED] Sent: Thursday, October 19, 2006 9:25 AM To: Robert Swan; SpamAssassin Users Subject: RE: Scoring PTR's     > -----Original Message----- > From: Robert Swan [mailto:[EMAIL PROTECTED]] > Sent: Thursday, October 19, 2006 9:10 AM > To: SpamAssassin Users > Subject: Scoring PTR's > > > Guys, I don't need a lesson on what you think should be done > or what you > think is the right thing to do, I just need help writing a > rule. I setup > mail servers all the time and I always make sure the: Mail server > broadcast name, the 'A' record and the PTR all match, IT IS JUST GOOD > PRACTICE, I am also not trying to block people who don't > qualify, I just > want to identify and score it!! > > I would appreciate some help writing this rule..the SPAMMER who sent > this knows what he/she is doing and it would be helpful to > identify this > trick. > > Received: from > *cirencester.co.uk*(*c204131.adsl.hansenet.de*[213.39.204.131]) Hey its your system, I'll help you mark it as spam if its got a Subject line! :) However, I don't think you will be able to do this with a straight rule. You will most likely need an Eval. --Chris The fact that Matt can quote actual RFC sections.....is scary :)