Mailing-List: contact users-help@spamassassin.apache.org; run by ezmlm
Precedence: bulk
Received-SPF: pass (athena.apache.org: local policy)
From: ".rp" <printer@afts.com>
To: bogofilter@bogofilter.org
Date: Wed, 07 May 2008 14:58:34 -0700
MIME-Version: 1.0
Subject: possible idea for backscatter problem
Message-ID: <4821C39A.23228.B9A6DF12@printer.moveupdate.com>
Priority: normal
Content-type: text/plain; charset=US-ASCII
Content-transfer-encoding: 7BIT
Content-description: Mail message body

One of the users (actually the boss) had the email address harvested and we got clobbered 
by backscatter. Looking at the emails of the various 'unable to deliver' type messages, I saw 
what these could be filtered on, but don't know how to write up and implement the rule 
outside of procmail. I don't want to use procmail for this since it I think it would be an 
expensive routine for procmail to run.

In the body of the 'unable to deliver' message, the original message is quoted. One of the 
lines quoted is the Message-ID: header from the original. The format of this line is always 
wrong as it does not contain the FQDN that our server appends to the end of the hash 
number , following the '@' symbol .

So, need a rule that would parse the "Message-ID:" in the body (or attachment) and not 
header, and look for the @FQDN 
Is this rule already out in the wild?
-p