# our MTAs fix up headers for a slew of spams, so mark these as suspicious
# -- joy, 2003-06-28
# deactivated as this rule is also part of SA itself.
-#header OUR_MTA_MSGID Message-Id =~ /\@(liszt|master|gluck)\.debian\.org/
+#header OUR_MTA_MSGID Message-Id =~ /\@(bendel|master|gluck)\.debian\.org/
#describe OUR_MTA_MSGID Sounds like a MsgId autogenerated by our MTAs
#score OUR_MTA_MSGID 1
# -- joy, 2003-08-15
-header SENDER_FOR_US From =~ /\@(liszt|master|gluck|lists)\.debian\.org/
+header SENDER_FOR_US From =~ /\@(bendel|master|gluck|lists)\.debian\.org/
describe SENDER_FOR_US Sounds like a mail aimed at tricking our MTAs
score SENDER_FOR_US 2
#describe OURCRONMAILS Sounds like a legitimate cron job mail
#score OURCRONMAILS -3
-header LISZT_LOCAL_FORWARDED Resent-From =~ /liszt\.debian\.org/
-describe LISZT_LOCAL_FORWARDED Mail has been locally forwarded.
-score LISZT_LOCAL_FORWARDED -5
+header BENDEL_LOCAL_FORWARDED Resent-From =~ /bendel\.debian\.org/
+describe BENDEL_LOCAL_FORWARDED Mail has been locally forwarded.
+score BENDEL_LOCAL_FORWARDED -5
# temp work-around for d-l-f