On Jun 10 Dave C. wrote:
>I just threw these together as part of an acl_data..
Nice (I'll definitely apply a varation of this :), but..
># All hotmail.com mail should have this header
> deny sender_domains = hotmail.com
^^^^
Do you not mean "warn" here? Your message looks like a header (and,
anyway, I'd be scared of rejecting for fear of those patterns changing..)
> message = X-Forgery: NOT HOTMAIL
> condition = ${if def:header_X-Originating-IP:{no}{yes}}