[Mimedefang] Quarantine based on content WAS: MIMEDefang 2.36-BETA-2 plus administrivia

[Stefano McGhee]

Hey Ken,
	I changed the subject o reflect what you were trying to do.  To
answer your first question: Yes, that can be done with SpamAssassin.  I
would just put something similar to:

rawbody MY_TRENDTEST /Trend SMEX Content Filter has detected sensitive
content/
describe MY_TRENDTEST Found something Trend thought was spam
score MY_TRENDTEST	20

Into my sa-mimedefang.cf file.  Headers may be more to your liking for the
test.  

	As for consensus, I think that most people agree that SOMEONE
should be notified in the case of non-delivery.  The only exception are
viruses that forge the from address.  I would recommend redirecting the bad
stuff to a spam mailbox so that a human can review it or delete it at their
leisure, but then again, I'm not at a high volume site.

Hope that helps,

Stefano

> 
> I was thinking it would be nice to have MIMEDefang (v2.35), 
> in conjunction
> with Mail::SpamAssassin (v2.55), examine each message and/or 
> attachments for
> the string "Trend SMEX Content Filter has detected sensitive 
> content".  If
> this string could be assigned an artificially high SA score, 
> MIMEDefang
> could then ensure that the bounce-back gets quarantined (and 
> therefore,
> removed from the queue).  We currently quarantine anything 
> with an SA score
> of 20 or greater.
> 

> However, what is the concensus regarding NOT sending back a 
> notification to
> a legitimate sender, who's original message may have been mistakenly
> identified (by Trend) as spam?
>