[SAde] ...

Lisa wrote:

> Hi,
>  I want to run a check on the Received From header but only the top most one.
>  The idea being to assign a penalty score if .dsl. shows as the top most
>  Received header. I want to penalize certain strings that aren't going
>  through their MX hosts. In other words, sending direct.
>  
>  thx for any ideas

I'm using this for example:

# Normally I don't get mails from there
# example: lsanca1-ar19-4-46-087-135.lsanca1.dsl-verizon.net
header          DL_f_DSLVERIZON         Received =~ /dsl-verizon\.net/i
describe        DL_f_DSLVERIZON         Received via DSL IP from Verizon
score           DL_f_DSLVERIZON         0.6

# example: midsouth-24-151-214-105.westtn.chartertn.net
header          DL_f_SPEEDYAR           Received =~ /\[0-9]{1,3}\-[0-9]{1,3}\-[0-9]{1,3}\-[0-9]{1,3}\.speedy\.com\.ar/i
describe        DL_f_SPEEDYAR           Received via dynamic ip client from Speedy AR
score           DL_f_SPEEDYAR           0.6

header          DL_f_CLCOMCAST          Received =~ /client\.comcast\.net/i
describe        DL_f_CLCOMCAST          Received via dynamic ip client from Comcast
score           DL_f_CLCOMCAST          0.6

header          DL_f_OPTONLINE          Received =~ /dyn\.optonline\.net/i
describe        DL_f_OPTONLINE          Received via dynamic ip client from Optonline
score           DL_f_OPTONLINE          0.6

header          DL_f_DYNSUSPECT         Received =~ /[0-9]{1,3}\-[0-9]{1,3}\-[0-9]{1,3}\-[0-9]{1,3}\./i
describe        DL_f_DYNSUSPECT         Received contains an ip like 100-100-100-100.domain
score           DL_f_DYNSUSPECT         0.4

You can try to modify this for your need.

-- 
Best Regards
Daniel Luttermann




-------------------------------------------------------
This SF.net email sponsored by: Enterprise Linux Forum Conference & Expo
The Event For Linux Datacenter Solutions & Strategies in The Enterprise 
Linux in the Boardroom; in the Front Office; & in the Server Room 
http://www.enterpriselinuxforum.com