On 04 Apr, Harriet Bazley <lists@xxxxxxxxxxxxxxxxxxxxxxxxxxx> wrote: [Snip] > Delete Message-Id: @ twodollars > And Message-Id: @ nodomain > And Subject: @ twowords > This seems to be picking out these spams and only these spams to date; > obviously, the two UserTests operating on the Message-Id could be > combined, but since I use the @twodollars test elsewhere I haven't > attempted it. Out of interest, how many of these are stopped by the dns blacklist feature in the latest alpha version? I was getting a *lot* of spam of the type you describe ("pump and dump" stock market stuff) but one checking the received headers with a port of rblcheck they all had listings in the spam IP blacklists. -- Steve Pampling