> Hello to all,
>
> I have a question about content filtering.
>
> Our list is set to:
>
> <--- pasted in relevant part --->
>
>  Validate=            yes,confirm
>  Review=              owners
>  Subscription=        open,confirm
>  Send=                Editor,Hold
> --- snipped a bunch ---
>  Editor= [log in to unmask]
>  Editor= (ME-PLATFORM)
>
> <--- end pasted header part --->
>
> In the content filters are lines like:
>
>  From: [log in to unmask]
>  Action: REJECT Spam not accepted
>
>  Subject: *-Mortgages*
>  Action: REJECT Possible spam detected, message not accepted
>
>  From: *@ATTBI.COM
>  Action: REJECT Possible spam detected, message not accepted
>
> and while the first two of the above work just fine, the third
> doesn't seem to work at all.
>
> The reason to filter on all with *@ATTBI.COM is that our list has
> no subscribers there but the percentage of received spam is about
> 80% coming in from [log in to unmask] for approval (due
> to the listheader settings offcourse).
>
> These postings have headers like:
>
> ---- pasted in from an approval request ----
> Return-Path: <[log in to unmask]>
> Received: from 192.87.5.140 (211.200.211.47) by nic.surfnet.nl (LSMTP for
> Windows NT v1.1b) with SMTP id <[log in to unmask]>; 25 Jul 2004
> 10:45:33 +0200 Received: from [211.200.211.47] by 92.224.44.186 with HTTP;
>  Sun, 25 Jul 2004 05:49:45 -0200
> From: "Sonya Solomon" <[log in to unmask]>
> To: [log in to unmask]
> Subject: Fw: Little red riding hood
> Mime-Version: 1.0
> Date: Sun, 25 Jul 2004 06:50:45 -0100
> Reply-To: "Sonya Solomon" <[log in to unmask]>
> ---- end header sample -----
>
> Looking at the "return-path" it seems that both ENVELOPE-FROM and
> MAIL-FROM contained @ATTBI.COM so why isn't this rejected but still
> send to the owner for approval? Did I make an error in the reject
> rule? Even more since the other rejection rules work just fine.
>
> We also receive postings from @ATTBI.COM at our request address but
> postings to request are not checked by the content controls as far
> as I understood?
>
> BTW - I know that there are probably non-spammers at ATTBI as well
> but since that isn't relevant for our list it is safe to reject
> based on that domain in our situation.

I'm not sure why this is not working unless a trailing * will make it
work. However, since you want to reject an entire domain, you should just
use the Filter= list keyword as this is what this is for.

Filter=Also, *@ATTBI.COM

For your content filtering you could experiment with:

Received: *@ATTBI.COM*
or
Return-Path: *@ATTBI.COM*

but the Filter=  keyword is the way to go in this case.