On Sat, 30 Jan 2010 09:32:31 +0000 Ned Slider <n...@unixmail.co.uk> wrote:
> Christian Brel wrote: > > > > header __HOTMAIL_SPX1 ALL =~ /Received\:.{1,30}hotmail\.com/i > > body __HOTMAIL_SPX2 /http\:\/\/groups\.yahoo\.com/ > > meta HOTMAIL_SPAM_GY (__HOTMAIL_SPX1 && __HOTMAIL_SPX2) > > score HOTMAIL_SPAM_GY 0.0 > > > > If I may... > > To match only Received headers: > > header __HOTMAIL_SPX1 Received =~ /.{1,30}hotmail\.com/i > > which incidentally will also match entries from > this-is-not-hotmail.com > - may or may not be what you intended. Indeed. It's probably fair to say that anyone using 'this-is-not-hotmail' would not really fall into my 'must have mail from' senders, but that's just a view. > > There is already a "from Hotmail" rule in 20_head_tests.cf for use in > meta rules that may suffice? > > header __FROM_HOTMAIL_COM From =~ /\...@hotmail\.com\b/i > > Also, you can use a uri rule for URIs, for example: > > uri __HOTMAIL_SPX2 m{https?://groups\.yahoo\.com\b} > It was a 'for instance' not a solid rule Ned, but as you've gone to so much trouble please feel free to finish the job and offer the whole rule :-)