[Mimedefang] Caching the results of a SpamAssassin scan

David F. Skoll dfs at roaringpenguin.com
Thu Apr 3 10:52:28 EST 2003


On Thu, 3 Apr 2003, Michael Sims wrote:

> Quoting Joseph Brennan <brennan at columbia.edu>:

> filter_relay.  According to the mimedefang-filter man page,
> $RelayAddr is not available in filter_end, where the SA scan takes
> place.

My version of the man page reads:

     The "built-in" globals like $Subject, $Sender, etc. are only  available
     to filter_begin, filter and filter_end.  They are not available to fil-
     ter_relay, filter_sender or filter_recipient.

> Rather than connect to a server, issue a
> MAIL FROM and then 100 RCPT TO's in succession, the spamware might
> run in a loop and send each message separately.

This happens a lot.  Usually, the message bodies are mutated to defeat
hashing techniques like Razor and DCC.  I'm not sure whether or not
Message-ID's are mutated also.

Regards,

David.



More information about the MIMEDefang mailing list