Hello, my brain is twisted as I tried all day to stop accepting mails with a subject matching "Fw: ${local_part}_report.pdf" as I face an unwanted wave of those mails.
As $local_part isn't available in system filters, I tried to workaround this by storing a "suspicious" subject after RCPT TO and comparing it with the subject after the DATA command: acl_smtp_rcpt = acl_check_rcpt acl_smtp_data = acl_check_data ... begin acl ... acl_check_rcpt: accept hosts = +relay_from_hosts control = submission set acl_c0 = Fw: ${local_part}_report.pdf acl_check_data: deny condition = ${if eq {$header_subject}{$acl_c0} {1}{0}} message = Bad Subject $header_subject 6287 processing "accept" 6287 check hosts = +relay_from_hosts 6287 check control = submission 6287 expanding: Fw: ${local_part}_report.pdf 6287 result: Fw: marco_report.pdf 6287 check set acl_c0 = Fw: ${local_part}_report.pdf 6287 = Fw: marco_report.pdf 6287 accept: condition test succeeded ... 6287 using ACL "acl_check_data" 6287 processing "deny" 6287 expanding: $header_subject}{$acl_c0} {1 6287 result: {1 6287 expanding: 0 6287 result: 0 6287 condition: eq {$header_subject}{$acl_c0} {1}{0} 6287 result: false 6287 expanding: ${if eq {$header_subject}{$acl_c0} {1}{0}} 6287 result: 6287 check condition = ${if eq {$header_subject}{$acl_c0} {1}{0}} 6287 = 6287 deny: condition test failed What did I miss? The expansion in the DATA acl looks... strange? I tried with exim 4.63 and 4.67, either versions work the same. Thanks for any hint. Kind regards -- Marco -- ## List details at http://www.exim.org/mailman/listinfo/exim-users ## Exim details at http://www.exim.org/ ## Please use the Wiki with this list - http://www.exim.org/eximwiki/