Hello to all,

I have a question about content filtering.

Our list is set to:

<--- pasted in relevant part --->

 Validate=            yes,confirm
 Review=              owners
 Subscription=        open,confirm
 Send=                Editor,Hold
--- snipped a bunch ---
 Editor= [log in to unmask]
 Editor= (ME-PLATFORM)

<--- end pasted header part --->

In the content filters are lines like:

 From: [log in to unmask]
 Action: REJECT Spam not accepted

 Subject: *-Mortgages*
 Action: REJECT Possible spam detected, message not accepted

 From: *@ATTBI.COM
 Action: REJECT Possible spam detected, message not accepted

and while the first two of the above work just fine, the third
doesn't seem to work at all.

The reason to filter on all with *@ATTBI.COM is that our list has
no subscribers there but the percentage of received spam is about
80% coming in from [log in to unmask] for approval (due
to the listheader settings offcourse).

These postings have headers like:

---- pasted in from an approval request ----
Return-Path: <[log in to unmask]>
Received: from 192.87.5.140 (211.200.211.47) by nic.surfnet.nl (LSMTP for Windows NT v1.1b) with SMTP id <[log in to unmask]>; 25 Jul 2004 10:45:33 +0200
Received: from [211.200.211.47] by 92.224.44.186 with HTTP;
 Sun, 25 Jul 2004 05:49:45 -0200
From: "Sonya Solomon" <[log in to unmask]>
To: [log in to unmask]
Subject: Fw: Little red riding hood
Mime-Version: 1.0
Date: Sun, 25 Jul 2004 06:50:45 -0100
Reply-To: "Sonya Solomon" <[log in to unmask]>
---- end header sample -----

Looking at the "return-path" it seems that both ENVELOPE-FROM and
MAIL-FROM contained @ATTBI.COM so why isn't this rejected but still
send to the owner for approval? Did I make an error in the reject
rule? Even more since the other rejection rules work just fine.

We also receive postings from @ATTBI.COM at our request address but
postings to request are not checked by the content controls as far
as I understood?

BTW - I know that there are probably non-spammers at ATTBI as well
but since that isn't relevant for our list it is safe to reject
based on that domain in our situation.

TIA,
Joop Reijenga.

 ps- a cc to my address would be appreciated since I'm on INDEX.