mentby.com
Blog | Jobs | Help | Signup | Login

sieve problem email silently discard



hello folks
hello Timo
hello all the guru

I met a few times the problem or an email that passes through a sieve script
is silently discard
after delivery but never returned to the inbox

all testimonials are welcome
--
  http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x0921[..]
 gpg --keyserver pgp.mit.edu --recv-key 092164A7


ml Tue, 21 Jun 2011 20:51:10 -0700

Op 22-6-2011 3:18, ml*******schreef:

We cannot say much about this problem, unless we get some more information:

1) What is your configuration? Provide the output of dovecot -n.

2) Is it reproducible somehow?

     - What is the Sieve script you see this behavior for? Or does it
happen for all users?

     - Is there a specific kind of incoming message that gets discarded
all the time?

3) Is there any error or other message in the logs that may explain this
behavior?

Regards,

Stephan.


Stephan Bosch Wed, 22 Jun 2011 01:22:26 -0700

Le mercredi 22 juin 2011 10:21, Stephan Bosch a écrit
 :

my dovecot -n
~]# /usr/sbin/dovecot -n
# 2.0.13: /etc/dovecot/dovecot.conf
# OS: Linux 2.6.32.2-xxxx-grs-ipv6-32 i686 CentOS release 5.6 (Final)
auth_mechanisms = plain login
base_dir = /var/run/dovecot/
lda_mailbox_autocreate = yes
lda_mailbox_autosubscribe = yes
listen = [::]
log_path = /var/log/maillog
log_timestamp = %Y-%m-%d %H:%M:%S
login_log_format_elements = user=<%u> method=%m rip=%r lip=%l %c
mail_location = maildir:~/Maildir
mail_max_userip_connections = 20
managesieve_notify_capability = mailto
managesieve_sieve_capability = comparator-i;octet comparator-i;ascii-casemap
fileinto reject envelope encoded-character vacation subaddress
comparator-i;ascii-numeric relational regex imap4flags copy include variables
body enotify environment mailbox date spamtest spamtestplus virustest
namespace {
  inbox = yes
  location  prefix  separator = .
}
passdb {
  driver = pam
}
plugin {
  autocreate = Trash
  autocreate2 = Junk
  autocreate3 = Sent
  autocreate4 = Drafts
  autosubscribe = Trash
  autosubscribe2 = Junk
  autosubscribe3 = Sent
  autosubscribe4 = Drafts
  plugin = $mail_plugins  autocreate managesieve  sieve
  sieve = ~/.dovecot.sieve
  sieve_before = /var/sieve-scripts/roundcube.sieve
  sieve_dir = ~/sieve
  sieve_global_path = whatever
}
protocols = sieve imap pop3
service auth {
  unix_listener /var/spool/postfix/private/auth {
    group = postfix
    mode = 0600
    user = postfix
  }
  unix_listener auth-master {
    mode = 0666
  }
  unix_listener auth-userdb {
    mode = 0666
  }
  vsz_limit = 64 M
}
service imap-login {
  inet_listener imap {
    port = 0
  }
  inet_listener imaps {
    address = * , [::]
    port = 993
  }
  process_limit = 128
  vsz_limit = 64 M
}
service imap {
  client_limit = 1
  service_count = 0
}
service managesieve-login {
  inet_listener managesieve-login {
    address = * , [::]
    port = 2000
  }
  process_limit = 128
  vsz_limit = 64 M
}
service pop3-login {
  inet_listener pop3 {
    port = 0
  }
  inet_listener pop3s {
    address = * , [::]
    port = 995
  }
  process_limit = 128
  vsz_limit = 64 M
}
ssl_ca = </etc/pki/tls/certs/class3.crt
ssl_cert = </etc/pki/tls/certs/r13151.ovh.net.cert
ssl_key = </etc/pki/tls/private/r13151.ovh.net.key
ssl_verify_client_cert = yes
userdb {
  driver = passwd
}
version_ignore = yes
protocol imap {
  imap_client_workarounds = delay-newmail tb-extra-mailbox-sep
  imap_max_line_length = 64 k
  mail_plugins = "   autocreate"
}
protocol pop3 {
  mail_plugins = autocreate
  pop3_client_workarounds = outlook-no-nuls oe-ns-eoh
  pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s
}
protocol lda {
  hostname = r13151.ovh.net
  mail_plugins = autocreate  sieve
  postmaster_address = postmaster*******
  sendmail_path = /usr/lib/sendmail
}
protocol sieve {
  managesieve_implementation_string = dovecot
  managesieve_logout_format = bytes ( in=%i : out=%o )
  managesieve_max_line_length = 65536
}

this is rare but does occur from time to time. I do not know how to reproduce

i use a simple script sieve
of this style
~]$ cat  .dovecot.sieve
require
["fileinto", "mailbox" ,"reject", "regex", "variables","envelope", "subaddress"];
# rule:[perl]
if anyof (header :contains "Return-Path" "perl.apache.org",
header :contains "Return-Path" "perl",header :contains "Return-Path" "groups.yahoo.com",
header :contains "Return-Path" "jaos",
header :contains "Return-Path" "dkimproxy",
header :contains "Return-Path" "mongueurs",
header :contains "Return-Path" "pep", header :contains "Subject" "dkimproxy",
header :contains "To" "perl*******",
header :contains "To" "pep*******",
header :contains "To" "perlwebmail-devel*******",
header :contains "Return-Path" "jlong*******",
header :contains "To" "dkimproxy-users*******",
header :contains "Cc" "dkimproxy-users*******")
{
        fileinto :create  "INBOX.perl";
        stop;
}

no there is no particular type of message just some messages

egrep lda /var/log/maillog

2011-06-22 14:34:45lda(fakessh): Info: sieve:
msgid=<4E01E14E.4040401*******>: marked message to be discarded if not
explicitly delivered (discard action)
2011-06-22 14:34:45lda(root): Info: sieve:
msgid=<4E01E14E.4040401*******>: marked message to be discarded if not
explicitly delivered (discard action)

thanks Stephan
--

  http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x0921[..]

 gpg --keyserver pgp.mit.edu --recv-key 092164A7


ml Wed, 22 Jun 2011 07:10:18 -0700

Op 22-6-2011 16:05, ml*******schreef:

Ok, so you are using multiscript with sieve_before.

:/

This is really strange. Even though your script does not contain a
discard command, the message is discarded through an explicit discard
action. I do notice that you are using the multiscript feature using
sieve_before and I expect that our problem is there. Notice that the
same message is discarded in an identical manner for two different users
(root and fakessh). What does /var/sieve-scripts/roundcube.sieve contain?

Also, it can be helpful to enable mail_debug to get more info on what
scripts are being executed and which script actually triggers the
discard action.

Regards,

Stephan.


Stephan Bosch Wed, 22 Jun 2011 07:42:59 -0700

Le mercredi 22 juin 2011 16:41, Stephan Bosch a écrit
 :

/var/sieve-scripts/roundcube.sieve
contains a series of commands to handle spam

~]# cat /var/sieve-scripts/roundcube.sieve

require
["fileinto","regex","comparator-i;ascii-numeric","reject","relational"];
# rule:[spammanage]
#if anyof (header :contains "X-Spam-Flag" "YES")
#{
#       fileinto "Junk";
#}
if header :value "ge" :comparator "i;ascii-numeric" ["X-Spam-score"] ["500"]  
{
  discard;
  stop;
}
if header :value "ge" :comparator "i;ascii-numeric" ["X-Spam-score"] ["100"]  
{
  fileinto "Junk.spam";
  stop;
}
if header :value "ge" :comparator "i;ascii-numeric" ["X-Spam-score"] ["10"]  {
  fileinto "Junk";
}

elsif anyof (
header :contains "Received"
             [ "[4.63.221.224",
               "[24.244.141.112",
               "[61.171.253.177",
               "[63.123.149.", "[63.209.206.", "(63.233.30.73", "[63.251.200.",
               "[64.41.183.","[64.49.250.", "[64.57.188.", "[64.57.221.",
               "[64.62.204.",
               "[64.70.17.", "[64.70.44.", "[64.70.53.",
               "[64.39.27.6", "[64.39.27.7","[64.191.25.","[64.191.36.",
               "[64.191.9.",
               "[64.125.181.", "[64.191.123.", "[64.191.23.", "[64.239.182.",
               "[65.211.3.",
               "[66.46.150.", "[66.62.162.", "[66.118.170.", "[66.129.124.",
               "[66.205.217.", "[66.216.111.", "[66.239.204.",
               "[67.86.69.",
               "[80.34.206.", "[80.80.98.",
               "[81.72.233.13",
               "[128.242.120.",
               "[157.238.18",
               "[168.234.195.18]",
               "[193.253.198.57",
               "[194.25.83.1",
               "[200.24.129.", "[200.161.203.",
               "[202.164.182.76]","[202.57.69.116",
               "[203.19.220.","[203.22.104.","[203.22.105.",
               "[204.188.52.",
               "[205.153.154.203",
               "[206.26.195.", "[206.154.33.","[206.169.178",
               "[207.142.3.",
               "[208.46.5.","[208.187.",
               "[209.164.27.","[209.236.",
               "[210.90.75.129]",
               "[211.101.138.199","[211.185.7.125]","[211.239.231.",
               "[212.240.95.",
               "[213.47.250.139", "[213.225.61.",
               "[216.22.79.","[216.39.115.","[216.99.240.",
               "[216.126.32.", "[216.187.123.","[217.36.124.53",
               "[218.145.25","[218.52.71.103","[218.158.136.115",
               "[218.160.42.74", "[218.242.112.4" , "[94.23.116.93"
             ]
)
{
        fileinto "Junk";
}
elsif anyof (
      header :contains ["SPAM", "X-Spam-hits"]
             ["ADDRESSES_ON_CD","ACT_NOW","and other hits"

             ]
)
{
        fileinto "Junk";
}

I just set up mail_debug = yes
I expect the next reject in order to give you more information

--

  http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x0921[..]

 gpg --keyserver pgp.mit.edu --recv-key 092164A7


ml Wed, 22 Jun 2011 08:17:42 -0700

hello folks
hello Timo
hello all the guru

I met a few times the problem or an email that passes through a sieve script
is silently discard
after delivery but never returned to the inbox

all testimonials are welcome

my dovecot -n
~]# /usr/sbin/dovecot -n
# 2.0.13: /etc/dovecot/dovecot.conf
# OS: Linux 2.6.32.2-xxxx-grs-ipv6-32 i686 CentOS release 5.6 (Final)
auth_mechanisms = plain login
base_dir = /var/run/dovecot/
lda_mailbox_autocreate = yes
lda_mailbox_autosubscribe = yes
listen = [::]
log_path = /var/log/maillog
log_timestamp = %Y-%m-%d %H:%M:%S
login_log_format_elements = user=<%u> method=%m rip=%r lip=%l %c
mail_debug = yes
mail_location = maildir:~/Maildir
mail_max_userip_connections = 20
managesieve_notify_capability = mailto
managesieve_sieve_capability = comparator-i;octet comparator-i;ascii-casemap
fileinto reject envelope encoded-character vacation subaddress
comparator-i;ascii-numeric relational regex imap4flags copy include variables
body enotify environment mailbox date spamtest spamtestplus virustest
namespace {
  inbox = yes
  location  prefix  separator = .
}
passdb {
  driver = pam
}
plugin {
  autocreate = Trash
  autocreate2 = Junk
  autocreate3 = Sent
  autocreate4 = Drafts
  autosubscribe = Trash
  autosubscribe2 = Junk
  autosubscribe3 = Sent
  autosubscribe4 = Drafts
  plugin = $mail_plugins  autocreate managesieve  sieve
  sieve = ~/.dovecot.sieve
  sieve_before = /var/sieve-scripts/roundcube.sieve
  sieve_dir = ~/sieve
  sieve_global_path = whatever
}
protocols = sieve imap pop3
service auth {
  unix_listener /var/spool/postfix/private/auth {
    group = postfix
    mode = 0600
    user = postfix
  }
  unix_listener auth-master {
    mode = 0666
  }
  unix_listener auth-userdb {
    mode = 0666
  }
  vsz_limit = 64 M
}
service imap-login {
  inet_listener imap {
    port = 0
  }
  inet_listener imaps {
    address = * , [::]
    port = 993
  }
  process_limit = 128
  vsz_limit = 64 M
}
service imap {
  client_limit = 1
  service_count = 0
}
service managesieve-login {
  inet_listener managesieve-login {
    address = * , [::]
    port = 2000
  }
  process_limit = 128
  vsz_limit = 64 M
}
service pop3-login {
  inet_listener pop3 {
    port = 0
  }
  inet_listener pop3s {
    address = * , [::]
    port = 995
  }
  process_limit = 128
  vsz_limit = 64 M
}
ssl_ca = </etc/pki/tls/certs/class3.crt
ssl_cert = </etc/pki/tls/certs/r13151.ovh.net.cert
ssl_key = </etc/pki/tls/private/r13151.ovh.net.key
ssl_verify_client_cert = yes
userdb {
  driver = passwd
}
version_ignore = yes
protocol imap {
  imap_client_workarounds = delay-newmail tb-extra-mailbox-sep
  imap_max_line_length = 64 k
  mail_plugins = "   autocreate"
}
protocol pop3 {
  mail_plugins = autocreate
  pop3_client_workarounds = outlook-no-nuls oe-ns-eoh
  pop3_logout_format = top=%t/%p, retr=%r/%b, del=%d/%m, size=%s
}
protocol lda {
  hostname = r13151.ovh.net
  mail_plugins = autocreate  sieve
  postmaster_address = postmaster*******
  sendmail_path = /usr/lib/sendmail
}
protocol sieve {
  managesieve_implementation_string = dovecot
  managesieve_logout_format = bytes ( in=%i : out=%o )
  managesieve_max_line_length = 65536
}

egrep lda /var/Log/maillog
2011-07-03 19:47:15lda: Debug: Loading modules from
directory: /usr/lib/dovecot
2011-07-03 19:47:15lda: Debug: Module
loaded: /usr/lib/dovecot/lib20_autocreate_plugin.so
2011-07-03 19:47:15lda: Debug: Module
loaded: /usr/lib/dovecot/lib90_sieve_plugin.so
2011-07-03 19:47:15lda(fakessh): Debug: Effective uid=500, gid=100,
home=/home/fakessh
2011-07-03 19:47:15lda(fakessh): Debug: Namespace : type=private, prefix=,
sep=., inbox=yes, hidden=no, list=yes, subscriptions=yes
location=maildir:~/Maildir
2011-07-03 19:47:15lda(fakessh): Debug: maildir++: root=/home/fakessh/Maildir,
index=, control=, inbox=/home/fakessh/Maildir
2011-07-03 19:47:15lda(fakessh): Debug: Namespace : Using permissions
from /home/fakessh/Maildir: mode=0775 gid=-1
2011-07-03 19:47:15lda(fakessh): Debug: userdb lookup skipped, username taken
from USER environment
2011-07-03 19:47:15lda(fakessh): Debug: none: root=, index=, control=, inbo2011-07-03 19:47:15lda(fakessh): Debug: Destination address:
fakessh*******(source: user@hostname)
2011-07-03 19:47:15lda(fakessh): Debug: sieve: using sieve path for user's
script: /home/fakessh/.dovecot.sieve
2011-07-03 19:47:15lda(fakessh): Debug: sieve: executed before user's
script(1): /var/sieve-scripts/roundcube.sieve
2011-07-03 19:47:15lda(fakessh): Debug: sieve: opening
script /var/sieve-scripts/roundcube.sieve
2011-07-03 19:47:15lda(fakessh): Debug: sieve: script
binary /var/sieve-scripts/roundcube.svbin successfully loaded
2011-07-03 19:47:15lda(fakessh): Debug: sieve: binary save: not saving
binary /var/sieve-scripts/roundcube.svbin, because it is already stored
2011-07-03 19:47:15lda(fakessh): Debug: sieve: executing script
from /var/sieve-scripts/roundcube.svbin
2011-07-03 19:47:15lda(fakessh): Info: sieve:
msgid=<6EBEE5FC-62B1-4C73-B26E-DEBFD6E26DB6*******>: marked message to
be discarded if not explicitly delivered (discard action)

--
  http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x0921[..]
 gpg --keyserver pgp.mit.edu --recv-key 092164A7


ml Sun, 03 Jul 2011 13:28:02 -0700

I would not call this a silent discard: it is reported in the log above.
Also, the contents of roundcube.sieve that you showed in an earlier
thread contained a single discard action, which is therefore the only
likely culprit. Now the question boils down to: why is this discard
action triggered? The interesting part of the script is the following:

require ["comparator-i;ascii-numeric","relational"];
if header :value "ge" :comparator "i;ascii-numeric"
["X-Spam-score"]["500"]
{
  discard;
  stop;
}

Since the message is discarded, it will most likely be impossible to
retrieve that message and check why it fires this rule. The relatively
innocent situation would be that your Spam filter truly produces this
interesting score of > 500. A less innocent case would be a bug in the
Sieve interpreter. Either way, we need to have access to one of those
messages that triggers this rule and gets discarded without apparent reason.

My suggestion is to replace that `discard;' action with a `fileinto
:create "Debug";' action (:create creates the folder implicitly; depends
on mailbox extension require) to file messages that would normally be
discarded into a special folder for later evaluation. Alternatively, you
can redirect such messages to a special mail account.

Only then can we trace this problem any deeper.

Regards,

Stephan.


Stephan Bosch Sun, 03 Jul 2011 14:57:58 -0700

thanks Stephan

I just change my sieve script by removing the implicit discard
a fileinto :create "Junk.spam.spam"

until next time

--
  http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x0921[..]
 gpg --keyserver pgp.mit.edu --recv-key 092164A7


ml Sun, 03 Jul 2011 15:45:22 -0700

Le lundi 4 juillet 2011 00:40, ml*******a écrit
 :

Hi Stephan

it just happened a mail that was issued in INBOX.spam.spam
supposedly a hit with spam than 500
which does not appear in the body of the mail here

Return-Path: <bar-return-176164-ml=smtp.fakessh.eu*******>
X-Original-To: fakessh*******
Delivered-To: fakessh*******
Received: from r13151.ovh.net (localhost.localdomain [127.0.0.1])
    by r13151.ovh.net (Postfix) with ESMTP id BC2C3CC08C
    for <fakessh*******>; Mon,  4 Jul 2011 10:15:22 +0200
(CEST)
X-SenderID: Sendmail Sender-ID Filter v1.0.0 r13151.ovh.net BC2C3CC08C
Authentication-Results: r13151.ovh.net; sender-id=none
header.from=mihamina*******; spf=none
smtp.mfrom=bar-return-176164-ml=smtp.fakessh.eu*******
Received-SPF: none (ml.ovh.net: No applicable sender policy available)
receiver=r13151.ovh.net; identity=mailfrom;
envelope-from="bar-return-176164-ml=smtp.fakessh.eu*******";
helo=67.mail-out.ovh.net; client-ip=91.121.***.68
X-SenderID: Sendmail Sender-ID Filter v1.0.0 r13151.ovh.net C0199CC08B
Authentication-Results: r13151.ovh.net; sender-id=none
header.from=mihamina*******; spf=none
smtp.mfrom=bar-return-176164-ml=smtp.fakessh.eu*******
Received: from 67.mail-out.ovh.net (67.mail-out.ovh.net [91.121.***.68])
    by r13151.ovh.net (Postfix) with SMTP id C0199CC08B
    for <ml*******>; Mon,  4 Jul 2011 10:15:14 +0200 (CEST)
Received: (qmail 27270 invoked by uid 503); 4 Jul 2011 08:16:42 -0000
Received: from b9.ovh.net (HELO mail200.ha.ovh.net) (213.186.33.59)
  by 67.mail-out.ovh.net with SMTP; 4 Jul 2011 08:16:42 -0000
Received: from b0.ovh.net (HELO queueout) (213.186.33.50)
    by b0.ovh.net with SMTP; 4 Jul 2011 10:15:03 +0200
Mailing-List: Pour toute requete administrative, contactez
bar-help*******; Liste geree par ezmlm
Precedence: bulk
X-No-Archive: yes
List-Post: <mailto:bar*******>
List-Help: <mailto:bar-help*******>
List-Unsubscribe: <mailto:bar-unsubscribe*******>
List-Subscribe: <mailto:bar-subscribe*******>
Reply-To: bar*******
Delivered-To: mailing list bar*******
Received: from b0.ovh.net (HELO queue) (213.186.33.50)
    by b0.ovh.net with SMTP; 4 Jul 2011 10:15:03 +0200
Received: from smtp-out.ma**gasy.com (41.204.104.33)
  by mx1.ovh.net with SMTP; 4 Jul 2011 10:15:01 +0200
Received: from smtp-2.****line.mg (unknown [41.204.104.56])
    (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
    (No client certificate requested)
    by smtp-out.ma**gasy.com (Postfix) with ESMTPS id D6B1B94661;
    Mon,  4 Jul 2011 11:15:00 +0300 (EAT)
Received: from localhost (antivirus3.ma**gasy.com [41.204.104.49])
    by smtp-2.****line.mg (Postfix) with ESMTP id BD6A36008C;
    Mon,  4 Jul 2011 11:15:00 +0300 (EAT)
X-Virus-Scanned: par antivirus3.ma***gasy.com
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Level:
X-Spam-Status: No, score=-1.9 required=7 tests=[BAYES_00=-1.9] autolearn=ham
Received: from smtp-2.b***line.mg ([41.204.104.56])
    by localhost (antivirus3.ma**gasy.com [41.204.104.49]) (amavisd-new, port
10024)
    with ESMTP id jEBXnDCKPoY4; Mon,  4 Jul 2011 11:14:54 +0300 (EAT)
Received: from packard.**tmb.org (staff-104-10.ma***gasy.com [41.204.104.10])
    by smtp-2.blueline.mg (Postfix) with SMTP id 5A89860064;
    Mon,  4 Jul 2011 11:14:53 +0300 (EAT)


ml Mon, 04 Jul 2011 05:25:14 -0700

Op 4-7-2011 14:19, ml*******schreef:

I've executed sieve-test with your script and message, which reproduces
the problem at my end:

===
$ sieve-test -t - -T level=matching ~/fakessh.sieve ~/fakessh.eml
       ## Started executing script 'frop'
    2: header test
    2:   starting `:value-ge' match with `i;ascii-numeric' comparator:
    2:   extracting `X-Spam-score' headers from message
    2:   matching value `-1.9'
    2:     with key `500' => 1
    2:   finishing match with result: matched
    3: jump if result is false
    3:   not jumping
    5: discard action; cancel implicit keep
    6: stop command; end all script execution
       ## Finished executing script 'frop'

Performed actions:

  * discard

Implicit keep:

   (none)

sieve-test(stephan): Info: final result: success
===

This turns out to be a classic mistake actually (which I didn't think of
either). It is related to the (admittedly counter-intuitive) nature of
the i;ascii-numeric comparator.

From RFC4790, Section 9.1.1
( http://tools.ietf.org/html/rfc4790#section-9.1.1 ):
`The "i;ascii-numeric" collation is a simple collation intended for use
with arbitrarily-sized, unsigned decimal integer numbers stored as octet
strings. US-ASCII digits (0x30 to 0x39) represent digits of the numbers.
Before converting from string to integer, the input string is truncated
at the first non-digit character. All input is valid; strings that do
not start with a digit represent positive infinity.'

This comparator thus works on UNSIGNED integers only. Even worse,
negative numbers are mapped to positive infinity, which is obviously >
500! There is your problem. I remember that issue was reported some time
ago by someone else too.

To solve your problem, you need to check for the negative sign first. E.g.:

require ["comparator-i;ascii-numeric","relational"];
if allof(
         not header :matches "x-spam-score" "-*",
         header :value "ge" :comparator "i;ascii-numeric" "x-spam-score"
"500")
{
   discard;
   stop;
}

Or, even better: start using the spamtest(plus) extension.

Regards,

Stephan.


Stephan Bosch Mon, 04 Jul 2011 06:05:17 -0700

a simple script are one syntax proximate to a sample exemple to stephan

how to make a complex script that deals with both spam spam hist flag suspicious address diverse

i try this
~]# cat /var/sieve-scripts/roundcube.sieve

require ["fileinto","regex","comparator-i;ascii-numeric","reject","relational","mailbox","reject","variables","envelope","subaddress"];
# rule:[spammanage]
#if anyof (header :contains "X-Spam-Flag" "YES")
#{
#       fileinto "Junk";
#}
if allof(
         not header :matches "x-spam-score" "-*",
         header :value "ge" :comparator "i;ascii-numeric" "x-spam-score"
"500")
{
   discard;
   stop;
}
if anyof (
   # puremsg scores (30% or higher)
   header :matches ["X-Spam-Flag"] ["Yes"]
) {
   fileinto "Junk";
   stop;
}

elsif anyof (
header :contains "Received"
             [ "[4.63.221.224",

             ]
)
{
        fileinto :create "Junk";
}
elsif anyof (
      header :contains ["SPAM", "X-Spam-Status"]
             ["ADDRESSES_ON_CD","ACT_NOW",
             ]
)
{
        fileinto :create "Junk";
}

or better much approch is
the succession a if anyof elsif anyof
not work for the discard action

--
  http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x0921[..]
 gpg --keyserver pgp.mit.edu --recv-key 092164A7


ml Wed, 06 Jul 2011 09:22:48 -0700

work well transform allof in anyof

--
  http://pgp.mit.edu:11371/pks/lookup?op=get&search=0x0921[..]
 gpg --keyserver pgp.mit.edu --recv-key 092164A7


ml Wed, 06 Jul 2011 09:32:39 -0700



Related Topics

Post a Comment