Rejo Zenger wrote:
I guess i'm just overlooking a thing here, but can someone explain why
this does not work?
QUAD = "([1-9]|[1-9][0-9]|1[0-9][0-9]|2([0-4][0-9]|5[0-5]))"
IP = "${QUAD}\.${QUAD}\.${QUAD}\.${QUAD}"
:0
* ! ^Received: \(from
* ! ^Received: from.*${IP}
[action: One of the servers did not record senders IP address.]
Replace
* ! ^Received: from.*${IP}
with
* $ ! ^Received: from.*${IP}
Note that 0 is a perfectly valid value, but excluded in your definition
of QUAD.
Also be aware that many systems located behind corporate (and
government...) firewalls do not record initial handoffs from user
workstations. This is not by itself a reliable stigma of spam or of
misconfigured servers.
--
Rik Kabel Old enough to be an adult
rik(_at_)netcom(_dot_)com