In a recent message Steven Pampling <steve.pampling@xxxxxxxxxxxxx> wrote: > On 26 Dec, Dave Barnett <as10@xxxxxxxxxxxxxxxxx> wrote: [...] >> > >> Fine if you are testing From: I was testing Received: , this is much >> less susceptible to spoofing as it is under the control of the isp's >> servers. > > Same principle, different character --> use ".mx (" > > Although when you are testing the received: the best ones to test for are > the IP addresses and a list of the top offenders can be derived from > www.spamhaus.org > and the latest 25 entries are at: http://www.spamhaus.org/sbl/latest.lasso > I had thought that that would be a good idea but a bit difficult to pick the best targets and they move quickly. The Spamhaus lists are an excellent way of confirming suspicions, thanks for the links. A couple of their top 10 isp's are in my delete list already. Verizon, Comcast and various flavours of Bell are in my sights but I am reluctant to list them as they carry ham too. -- Dave Keep GMT all year