LuKreme wrote:
This is what I have in local.cf
(single lines)
header KB_RATWARE_OUTLOOK_16 ALL =~ /^Message-Id:
<....([0-9a-f]{8})\$([0-9a-f]{8})\$.{100,400}boundary="----=_NextPart_000_...._\1\.\2/msi
# "
header KB_RATWARE_OUTLOOK_12 ALL =~ /^Message-Id:
<....([0-9a-f]{8})\$([0-9a-f]{4})[0-9a-f]{4}\$.{100,400}boundary="----=_NextPart_000_...._\1\.\2/msi
# "
header KB_RATWARE_BOUNDARY ALL =~ /^Message-Id:
<....([0-9a-f]{8})\$[0-9a-f]{8}\$.{100,400}boundary="----=_NextPart_000_...._\1\./msi
# "
score KB_RATWARE_BOUNDARY 2.0
score KB_RATWARE_OUTLOOK_16 0.1
Can you please explain the rationale behind your scoring. I've just
installed these 3 rules to test and so far either all 3 are being
triggered on spam, or none at all. Presumably BOUNDARY is deemed safer
(less FP potential) than OUTLOOK_12 or OUTLOOK_16.
