I got a few spams last month that had exclamation marks and dollar signs
in odd places in the headers. I decided to use scoring to look for
two or more of these. If there, then go on to do a certain body
grep that I won't get into here.
The Message-ID: header, though, often can have legit `$' chars in it.
I wanted to exclude that header. The following may or may not be
a bit sloppy (improvements solicited!); but it's what I came up with:
:0 i # two+ `!' or `$' symbols in headers . . .
* ! ^(Return-Path|Sender):.*list
* -175^0
* 100^1 [$!]
* -100^1 ^Message-ID:.*[$!]
{ do some other things if we're here }
So, I had a piece of mail come in that had two `$' chars in the
Message-ID: header. There were no other `!' or `$' signs in the
Filtering on chars in message-id seems to me fraught with the risk of
mis-identifying legit mail as spam.
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail