Dan Barker wrote on Mon, 20 Aug 2007 09:05:44 -0400: > a) Investigate the possibility of FP's due to this change. It "looks" OK to > me, but I don't have a large corpus of non-bounce delivery status > notifications against which to test (er, ah, I have none<g>)
As this rule *wants* to match non-malware bounces it would be hard to define an FP in this case. ;-) Actually, I think you could make it much more generic without creating FPs. /Delivery Status Notification/ /Delivery Failure Notification/ -> /Delivery.*Notification/ should be ok to use. There is a slight chance it matches a "Delivery Notification" that comes from UPS or a cargo carrier, in case they send out something like this, but at least I haven't yet seen any. Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive.com
