On Tue, 29 Sep 2015, John Hardin wrote:
On Tue, 29 Sep 2015, Philip Prindeville wrote:
Can you use something like:
header __L_X_NO_RELAY exists:X-No-Relay
Are you seeing empty X-No-Relay headers? How about:
header __HAS_NO_RELAY X-No-Relay =~ /./
Oops. If you're going to multiple that, do this:
header __HAS_NO_RELAY X-No-Relay =~ /^./
...which is in my sandbox, but just for eval, it's not scored yet:
http://ruleqa.spamassassin.org/20150926-r1705400-n/__HAS_NO_RELAY/detail
tflags __L_X_NO_RELAY multiple
meta MULTIPLE_X_NO_RELAY __L_X_NO_RELAY >= 8
If you're doing that, do TFLAGS multiple, maxhits=9
I'll add this to my sandbox.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
I'm seriously considering getting one of those bright-orange prison
overalls and stencilling PASSENGER on the back. Along with the paper
slippers, I ought to be able to walk right through security.
-- Brian Kantor in a.s.r
-----------------------------------------------------------------------
