On Saturday 24 January 2009 19:23:35 Eli Wapniarski wrote: > > Oh.. one more note. If you notice the "IllegitimateTo" a lotta mail will > > try to sneak under the wire of filters by > > > > adding a dot infront of a > > > > legitimate email address. And that line takes care of it > > Oops correction. I did not mean to say that it contains a dot. I meant to > say a > > "by adding a space infront of a ..." > > > Eli Last one I promise. Sheesh I must be getting old or something. Anyway... it's not a dot or space but, the period infront of the email addresses in front of the line: IllegitimateTo = header /^TO$/i /(\.email at ddress.1\>|\.email at address.2\>)/e means a string including what follows after the dot. There seems to be a lot of "malmail" that is designed not to get to any recipient, but only to clog up mail servers with no such address ping pong repsonses. False recipients and mail with recipient strings that include legit email address but also have infront of the string garbage characters. That line takes care of those. Eli -- This message has been scanned for viruses and dangerous content by MailScanner, and is believed to be clean.