Perhaps I'll elaborate. We have a deprecated ISP account which I'll call [EMAIL PROTECTED] . I notice a lot of spam not being tagged with too low a score going to this address, but a distinguishing feature of much of it is that the To: header contains [EMAIL PROTECTED] . So, I want to be able to tell SA that anything which contains To: [EMAIL PROTECTED] but does not contain To: [EMAIL PROTECTED] is most likely spam.
What I really would like is a regex to place in a HEADER test, but I'm a novice at regexs and can't see a way to do this. Perhaps there is?
I'd do a meta test myself.. something like this:
header __FROM_BADDOMAIN From =~ /baddomain\.com/i
header __FROM_BADDOMAIN_GOOD_ADDR From =~ /[EMAIL PROTECTED]/i
meta FROM_BADDOMAIN_NOT_GOOD (__FROM_BADDOMAIN && ! __FROM_BADDOMAIN_GOOD_ADDR)
score FROM_BADDOMAIN_NOT_GOOD 20.0
Note: the above was written off the top of my head and might contain typos, syntax errors, etc and isn't tested. But, it gets the idea across.
