I have my recipe that matches "broadwing.net" in the Received: lines,
clones it, adds a X-Spam header, and drops a copy in a dedicated
spool. I'm cloning the message for now until I'm sure I won't lose
much legit mail.
:0c
* ? formail -x"Received:" | egrep -is "broadwing.net"
{
:0f
| formail -I "X-Spam: broadwing.net"
:0:
/var/spool/mail/quarantine/spam/broadwing.net
}
I checked the spool today and found a couple false positives. All of
them are netzero.net mail that went through broadwing like the one
below.
Return-Path: <munged(_at_)netzero(_dot_)net>
Received: from mail9.wlv.netzero.net (mail9.wlv.netzero.net [209.247.163.66])
by munged.net (8.11.5/8.11.5) with SMTP id fATG55t06999
for <tlh(_at_)munged(_dot_)net>; Thu, 29 Nov 2001 10:05:05 -0600
Received: (qmail 22150 invoked from network); 29 Nov 2001 16:05:03 -0000
Received: from ppp-216-143-157-81.mclass.broadwing.net (HELO a4p1b8)
(216.143.157.81)
by mail9.wlv.netzero.net with SMTP; 29 Nov 2001 16:05:03 -0000
From: "munged" <munged(_at_)netzero(_dot_)net>
Is there a way to match broadwing.net in the Received line but not if
one also contains the strign netzero.net?
Thanks
Justin
--
--
Justin Shore, ES-SS ES-SSR Pittsburg State University
Network & Systems Manager Kelce 157Q
Office of Information Systems Pittsburg, KS 66762
Voice: (620) 235-4606 Fax: (620) 235-4545
http://www.pittstate.edu/ois/
Warning: This message has been quadruple Rot13'ed for your protection.
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail