The following should work:
:0:
* !^Message-ID:[ ]*<1997(_dot_)*(_at_)(_dot_)*>
foldername
(perhaps the extra (_dot_)*(_at_)(_dot_)*> is over kill, but)
However: mailers like pine, (I think ms mailerss), etc. put their
names&osnames at the head of the message-id field (check the mid on this
message for an example).
This -- I believe -- should get past that:
:0:
* ! ^Message-ID:[ ]*<[a-zA-Z]*(_dot_)*(_at_)(_dot_)*>
* ! ^Message-ID:[ ]*<1997(_dot_)*(_at_)(_dot_)*>
foldername
Note: the "[ ]"s contain a tab and a space.
On Sun, 31 Aug 1997, Tomas Karlsson wrote:
Hi,
I receive many spams with forged message-ID, such as this one:
Message-ID: <353527657849(_dot_)CAA49873(_at_)mkmniforu(_dot_)com>
Is there a ways to check if the message-id header line begins with
Message-ID: <1997
..and send such message directly to a folder called bad_id?
I am not very good with the regular expressions, but I image this
wouldn't be too difficult for a procmail guru.
Tomas Karlsson
webmaster(_at_)iimagers(_dot_)com