Micah Anderson wrote:

> Joseph Brennan writes:
>
> >> Reply-to: s.team43@live.com

> >
> >
> > First pass:
> >
> > header LOCAL_REPLYTO_LIVE Reply-to =~ /\@live\.com/
> > score LOCAL_REPLYTO_LIVE 8.0
> >
> > Maybe scoring 8.0 for one thing scares you, but I haven't seen this
> > fp in a couple of months.

>
> Is live.com a legitimate email sender? It looks microsoft related. If I
> set it to 8, then any mail from that address is surely to get caught as
> spam, which may not be the right thing depending on other potential
> legitimate addresses sending from that domain.


It is Microsoft:

% whois `dig +short live.com`

OrgName: Microsoft Corp
OrgID: MSFT
Address: One Microsoft Way
....

> Or perhaps nothing but spam comes from live.com? I dont know anything
> about it.


We get some legitimate email from @live.com users.

--
Sahil Tandon