> On May 22, 2017, at 11:23 AM, Clifford Gonsalves
> <[email protected]> wrote:
>
> I would like to block any sender having the word "welcome" in the email
> address.
WHICH email address, the envelope sender, or the "From:" header? Blocking on
header content is rather more prone to false positives than blocking envelope
sender addresses.
> I know this can be done with header_checks, I just need the syntax to add
> this rule.
But it is likely unwise to keep such a rule in place for any length of time.
What counteracts a spam pattern lasting days to weeks eventually becomes a
source of false positives that makes inbound email unreliable.
If it all possible avoid single-word anti-spam patterns. Find something
actually
objectionable in the content or work with IP reputation, ...
--
Viktor.
