> Hello to all, > > I have a question about content filtering. > > Our list is set to: > > <--- pasted in relevant part ---> > > Validate= yes,confirm > Review= owners > Subscription= open,confirm > Send= Editor,Hold > --- snipped a bunch --- > Editor= [log in to unmask] > Editor= (ME-PLATFORM) > > <--- end pasted header part ---> > > In the content filters are lines like: > > From: [log in to unmask] > Action: REJECT Spam not accepted > > Subject: *-Mortgages* > Action: REJECT Possible spam detected, message not accepted > > From: *@ATTBI.COM > Action: REJECT Possible spam detected, message not accepted > > and while the first two of the above work just fine, the third > doesn't seem to work at all. > > The reason to filter on all with *@ATTBI.COM is that our list has > no subscribers there but the percentage of received spam is about > 80% coming in from [log in to unmask] for approval (due > to the listheader settings offcourse). > > These postings have headers like: > > ---- pasted in from an approval request ---- > Return-Path: <[log in to unmask]> > Received: from 192.87.5.140 (211.200.211.47) by nic.surfnet.nl (LSMTP for > Windows NT v1.1b) with SMTP id <[log in to unmask]>; 25 Jul 2004 > 10:45:33 +0200 Received: from [211.200.211.47] by 92.224.44.186 with HTTP; > Sun, 25 Jul 2004 05:49:45 -0200 > From: "Sonya Solomon" <[log in to unmask]> > To: [log in to unmask] > Subject: Fw: Little red riding hood > Mime-Version: 1.0 > Date: Sun, 25 Jul 2004 06:50:45 -0100 > Reply-To: "Sonya Solomon" <[log in to unmask]> > ---- end header sample ----- > > Looking at the "return-path" it seems that both ENVELOPE-FROM and > MAIL-FROM contained @ATTBI.COM so why isn't this rejected but still > send to the owner for approval? Did I make an error in the reject > rule? Even more since the other rejection rules work just fine. > > We also receive postings from @ATTBI.COM at our request address but > postings to request are not checked by the content controls as far > as I understood? > > BTW - I know that there are probably non-spammers at ATTBI as well > but since that isn't relevant for our list it is safe to reject > based on that domain in our situation. I'm not sure why this is not working unless a trailing * will make it work. However, since you want to reject an entire domain, you should just use the Filter= list keyword as this is what this is for. Filter=Also, *@ATTBI.COM For your content filtering you could experiment with: Received: *@ATTBI.COM* or Return-Path: *@ATTBI.COM* but the Filter= keyword is the way to go in this case.