Rule # 1:

Don't use content filters to check for postings from "spammers" (but use
list definition keyword FILTER= ALSO,rfc822_address,wild_card_addresses )

Question # 1

Do you really want non-subscribers to be moderated? Or maybe just
rejected? If the latter, SEND= PRIVATE might be better.

Hint # 1

Don't use content filters for anti-spam (which I believe is what it says
also in the manual).

/Pete

At 07:05 07/25/2004 Sunday, Joop Reijenga wrote:
 >Hello to all,
 >
 >I have a question about content filtering.
 >
 >Our list is set to:
 >
 ><--- pasted in relevant part --->
 >
 > Validate=            yes,confirm
 > Review=              owners
 > Subscription=        open,confirm
 > Send=                Editor,Hold
 >--- snipped a bunch ---
 > Editor= [log in to unmask]
 > Editor= (ME-PLATFORM)
 >
 ><--- end pasted header part --->
 >
 >In the content filters are lines like:
 >
 > From: [log in to unmask]
 > Action: REJECT Spam not accepted
 >
 > Subject: *-Mortgages*
 > Action: REJECT Possible spam detected, message not accepted
 >
 > From: *@ATTBI.COM
 > Action: REJECT Possible spam detected, message not accepted
 >
 >and while the first two of the above work just fine, the third
 >doesn't seem to work at all.
 >
 >The reason to filter on all with *@ATTBI.COM is that our list has
 >no subscribers there but the percentage of received spam is about
 >80% coming in from [log in to unmask] for approval (due
 >to the listheader settings offcourse).
 >
 >These postings have headers like:
 >
 >---- pasted in from an approval request ----
 >Return-Path: <[log in to unmask]>
 >Received: from 192.87.5.140 (211.200.211.47) by nic.surfnet.nl (LSMTP for
 >Windows NT v1.1b) with SMTP id <[log in to unmask]>; 25 Jul 2004
 >10:45:33 +0200
 >Received: from [211.200.211.47] by 92.224.44.186 with HTTP;
 > Sun, 25 Jul 2004 05:49:45 -0200
 >From: "Sonya Solomon" <[log in to unmask]>
 >To: [log in to unmask]
 >Subject: Fw: Little red riding hood
 >Mime-Version: 1.0
 >Date: Sun, 25 Jul 2004 06:50:45 -0100
 >Reply-To: "Sonya Solomon" <[log in to unmask]>
 >---- end header sample -----
 >
 >Looking at the "return-path" it seems that both ENVELOPE-FROM and
 >MAIL-FROM contained @ATTBI.COM so why isn't this rejected but still
 >send to the owner for approval? Did I make an error in the reject
 >rule? Even more since the other rejection rules work just fine.
 >
 >We also receive postings from @ATTBI.COM at our request address but
 >postings to request are not checked by the content controls as far
 >as I understood?
 >
 >BTW - I know that there are probably non-spammers at ATTBI as well
 >but since that isn't relevant for our list it is safe to reject
 >based on that domain in our situation.
 >
 >TIA,
 >Joop Reijenga.
 >
 > ps- a cc to my address would be appreciated since I'm on INDEX.
End Reply