Excerpts from mail: (01-Oct-97) "Authenticated sender" gives false positive by
Matt Garretson
For a few months i've happily been using the "Comments: Authenticated
sender is..." header to filter out spam. Till now it has worked great --
never nailed a legitimate message. However, today it did return a false
positive. Below are the headers. Did i miss anything?
[...]
Message-Id: <199710011145(_dot_)EAA23554(_at_)esri(_dot_)com>
[...]
ESRI-L is a valid mailing list. Since there were no X-PMFLAGS, X-Mailer, or
Resent- headers, i'm not sure what else to look for.
It looks like whatever mailing list software ESRI-L is using seriously munges
the headers of e-mail distributed by it. Note how it has obviously changed
the Message-Id: header. I consider that a major no-no when it comes to
mailing list software. I would complain to the mailing list administrator. In
the meantime, you can rely on the altered Message-Id: in your "Comments:
Authenticated sender is..." filter to eliminate false positives like so:
:0:
* ^Comments:[ ]*Authenticated sender is
* !^X-Mailer:.*Pegasus Mail
* !^Resent-To:
* !^Message-Id:(_dot_)*(_at_)esri\(_dot_)com>
{ ...spam processing... }
Later,
Ed