Re: Why'd VBounce not hit?

Kai Schaetzl writes:
> Dan Barker wrote on Mon, 20 Aug 2007 09:05:44 -0400:
>
> > a) Investigate the possibility of FP's due to this change. It "looks" OK to
> > me, but I don't have a large corpus of non-bounce delivery status
> > notifications against which to test (er, ah, I have none<g>)
>
> As this rule *wants* to match non-malware bounces it would be hard to define
> an FP in this case. ;-)
> Actually, I think you could make it much more generic without creating FPs.
>
> /Delivery Status Notification/
> /Delivery Failure Notification/
>
> ->
>
> /Delivery.*Notification/
>
> should be ok to use. There is a slight chance it matches a "Delivery
> Notification" that comes from UPS or a cargo carrier, in case they send out
> something like this, but at least I haven't yet seen any.

actually, it's better to keep these Subject rules as *non*-generic as possible -- as you note, "notifications" about "deliveries" are not rare, and FPs are best avoided.

I'd even suggest:

  /^Delivery Status Notification/
  /^Delivery Failure Notification/

--j. Received on Mon Aug 20 13:33:06 2007