Thank you, again, Rolf.  Unfortunately, these are not fake usernames associated with my Mercury server.  They are usernames associated with one of the ISPs that I use.  They may or may not be fake.  The significance is that I see quite a lot of SPAM with multiple usernames (all starting with "g" as the first letter, presumably because the first letter of my usename starts with "g") at that ISP and it seems a good clue that the message is SPAM, as none of my correspondents use that ISP.

I looked at Graywall recently and gained the impression that I couldn't use it effectively, as quite a bit of my mail gets forwarded from another ISP to the one that I directly connect to with Mercury's Distributing POP3 Client.  I haven't tried SpamHalter so far, as I am having a fair amount of success with what I am currently doing.  Basically, I only accept mail without question from addresses that I have listed in Mercury's userlists and whitelist.  This allows me to have zero SPAM to my and my wife's user accounts.  Everything else is considered to be SPAM (which is deleted without any manual inspection) or potentially SPAM, which goes to a SPAM account.  It's the SPAM account that I have to work on to create rules to recognize real SPAM.  Of course, when people change their e-mail addresses without telling me, their messages end up as possible SPAM in the SPAM account.  This doesn't happen very often.

Gordon

Is anyone aware of any documentation about Mercury's Content Control message testing other than what is available from the internal Help?  Although the Help files have been very useful, there are still issues that I either don't understand or don't know how to deal with.  Some examples are:

Is "if SUBJECT CONTAINS ..." and "if SUBJECT HAS ..." identical, if only one word is being tested?

Using the CONTAINS and HAS functions, is all of the string content taken literally?  I am assuming that it is, e.g. * (asterisk) cannot be used as a wild-card for these functions.  This is only available in regular expressions.  Is this correct?

I am seeing some strings that seem to be getting past the message testing without being weighted.  As one example, I have a test which says "if SUBJECT HAS "Ph.d" weight 51", but I am still seeing messages with "Ph.d" in the Subject.

I am looking for a way to get rid of messages that, in the To: field, contain multiple addresses that have the same hostname as one of my e-mail addresses, but with different usernames (always with the same first letter in the username), including my own.  I know how to identify these messages by running an external program from Mercury's Filtering Rules, but it would be nice to do it all using Mercury's internal capabilities.  An example of a To: field like this is, georgesmith@myisp.com, grahambaker@myisp.com, gordonsurname@myisp.com, gillmadison@myisp.com, with each of these addresses on a different line in the To: header field.

Thank you

Gordon

The content control features are pretty well described in the PDF manual. If you have look at the section "Mercury's Content Control Filtering Language" you should find answers for most of your questions. In short, CONTAINS is simple sub-string matching with no wildcards allowed, MATCHES uses regular expressions with wildcards etc, HAS should be used for testing against a list of words only.

/Rolf 

Thank you for the reply, Rolf.  I looked at the PDF file and it seemed to be very similar to the contextual Help that one can use from within Mercury.  Whether it's identical, I am not sure, as I haven't compared it word-for-word.  However, what you have said, together with re-reading the Help/PDF confirms some of my assumptions.  Although HAS is intended to be for a list, I wasn't sure whether it would fail if it was a list of one word.  If this is so, I will have to change a lot of HAS statements to CONTAINS.  I set these up quite a while ago.

I still can't see anything that will help to detect cases of a list of similar e-mail addresses in the To: header, but maybe I can do something through the filtering rules.

Thank you

Gordon

If you get multiple fake recipients in the same message you could perhaps stop it at SMTP level using the compliance feature "Limit maximum number of failed RCPTs". Creating a rule or set of rules to handle it could work if there are not so many users in your system.

Then again, Graywall or SpamHalter will catch most spam anyway.

/Rolf