We seem to be getting good hitrates for keyword checking, even with the junk html style that spammers use. However, some standard messages that are reliably blocked 99% of the time still get through, even though there is a keyword filter that will block them (a non html commented web address for example).

Spamfilter (build 124) reports that some messages can't be checked by the keyword filter - I'm assuming that these are ones getting through.

Is it possible to block these in Spamfilter or would that be dangerous?

I know the new version has RegEx and we will be installing it probably in a fortnight... is this a better safer solution?

Martin,

I STRONGLY recomend the use of RegEX.

The following, in your keyword list knocks that one right out.

(<[!--]+[a-zA-Z0-9]{11,})

I am also using the following expressions to kill "dotted IP" URL's because we feel that if a link dowsn't have a FQDN, then the gererator of the message is either lazzy or is sending Spam.

(href="http://+[\d])
(href="http://%[\d])

We are actually using ONLY regular Expressions in our Keyword list to kill the "Spam flavor" of a message, rather than "censoring" email.

Dan S.