procmail
[Top] [All Lists]

Re: helo=<IP> detection

2006-11-17 07:31:05
Michelle Konzack schreef:

  :0
  * ^X-Mailer:.*Outlook
  * ^Received:.*\(helo=\[\/[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\]\)
  .ATTENTION.VirusSpam/

but sometimes it does not work.

Why are you using the \/ MATCH operator in there?

What do you mean by "not work", does the recipe match too many messages?
Too few? Something else?

The recipe will catch messages that contain a very specific Received:
header field, namely containing (case-insensitive!)
"(helo=[12.34.56.78])".
(the 12.34.56.78 as example)

Is that specific Received header field added by your fetchmail or local
MTA? Don't you want to limit this recipe to the very first (or second
etc.) Received header field?

   :0
   * ^X-Mailer:.*Outlook
   * ^Received:\/.+
   * MATCH ?? ()\(helo=\[\/[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+]\)
   .ATTENTION.VirusSpam/

-- 
Groet, Ruud


____________________________________________________________
procmail mailing list   Procmail homepage: http://www.procmail.org/
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail

<Prev in Thread] Current Thread [Next in Thread>