procmail
[Top] [All Lists]

Re: Recipe not working

2008-07-21 17:51:03
At 16:08 2008-07-21 -0700, Rem P Roberti wrote:

I suppose you're right.  I'll create a separate mailbox for all this
stuff and see if I can get it to work that way.  There is the
possibility that I might miss something important.

Yea, /dev/null is pretty harsh, even for suspect spam. What you could do instead is increment a counter, and use the test as a "spammishness" indicator. If several OTHER things are funky about the message, THEN you treat it like spam. This is a reasonably effective approach and generally not too prone to false positives (unless you have a lot of morons for friends).

My guess is that you have something that is delivering to $DEFAULT before the recipe is reached, because it's syntactically fine.


BTW, using SCORING is another approach. This particular example is a bit more involved, but it's all good anyway:

# Extract To/Cc into a variable
:0
* ^To:\/.*
{
        RECIPIENTS=$MATCH
}

:0
* ^Cc:\/.*
{
        RECIPIENTS="$RECIPIENTS, $MATCH"
}

# define the threshold as a negative - must get this many PLUS ONE to
# match true.
:0
* -11^0
* $ 1^1 RECIPIENTS ?? (_dot_)+(_at_)(_dot_)+
{
        # treat as spammy
}


Then, if you log, you'll see stuff like:

procmail: Score:     -11     -11 ""
procmail: Score:      55      44 "(_dot_)+(_at_)(_dot_)+"



Barring anything else, just LOGGING this attribute would allow you to see how much of your mail would be subject to the filter if it was being treated as an all-out spam indicator, as well as how much stuff might be coming in just below the threshold you set.

The two very trivial recipes that compile the RECIPIENT list are actually used in my own procmailrc for getting all potential cleartext recipients into one string so I can check for similar strings in the list - such as joe(_at_)yourdoman, along with joe(_at_)otherdomain, joe(_at_)yetanotherdomain, etc.

---
 Sean B. Straw / Professional Software Engineering

 Procmail disclaimer: <http://www.professional.org/procmail/disclaimer.html>
 Please DO NOT carbon me on list replies.  I'll get my copy from the list.

____________________________________________________________
procmail mailing list   Procmail homepage: http://www.procmail.org/
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail

<Prev in Thread] Current Thread [Next in Thread>