Recipe:
:0
* ^Comments:.*authenticated\ sender\ is
/dev/null
This recipe should catch everything with either a "Comments: Authenticated
sender..." or "X-PMFLAGS" header (the first condition), that was not
mailed by Pegasus (the second condition) or forwarded by Pegasus (the
third condition--Pegasus evidently does *not* add the X-mailer header if
you use it to forward a message, and my last false positive was on
something that was forwarded to me by a friend who uses Pegasus).
If you really want to, of course, you can replace the { ... } section with
/dev/null; personally, I'd recommend that you set the SPAMFOLDER to some
suitable variable so you can still read false positives.
# Not sent with Pegasus Mail; "Comments" or "X-PMFLAGS" line forged
:0
* ^()\/(Comments.*Authenticated sender|X-PMFLAGS)
* !^X-mailer: Pegasus
* !^Resent-To:
{
EXITCODE=77
LOG="spamkill: Sender forged $MATCH line
"
:0:
$SPAMFOLDER
}
--
korthmat(_at_)cps(_dot_)msu(_dot_)edu http://www.cps.msu.edu/~korthmat
*** People who send me UCE/UBE will be crucified. ***
"That's SULTAN Vile Betrayer to you!"