Try these instead. Yours are syntactically correct but I don't believe
they will approach doing what you want.
--8<--
header __FAKE_FROM_MYCOMP from =~ /[EMAIL PROTECTED]/
header __FAKE_TO_MYCOMP to =~ /[EMAIL PROTECTED]/
meta FROM_MYCOMP_TO_MYCOMP (( __FAKE_FROM_MYCOMP + __FAKE_TO_MYCOMP) > 1)
score FROM_MYCOMP_TO_MYCOMP 20.0
--8<--
I tweaked it to get xyz.com specifically rather than anything at @xyz*.
{^_^}
----- Original Message -----
From: "Pierre Thomson" <[EMAIL PROTECTED]>
To: "Lean Cornelius" <[EMAIL PROTECTED]>; "spamassassin user group"
<[EMAIL PROTECTED]>
Sent: Wednesday, 2004 August, 11 06:09
Subject: RE: Rule Writing
Lean,
Your rule looks syntactically correct... I would be interested in seeing a
header that triggered the rule.
BTW, I always score a new rule very low (0.1) and run "spamassassin -t" on a
bunch of mails before I start using it for real. Losing legitimate mail
does not make you popular!
Pierre Thomson
BIC
-----Original Message-----
From: Lean Cornelius [mailto:[EMAIL PROTECTED]
Sent: Wednesday, August 11, 2004 8:45 AM
To: spamassassin user group
Subject: Rule Writing
Hi users
I have asked this question before, but did not receive any feedback.
Im really getting desperate, and the problem is getting out of hand now.
If there is anyone with advise on this, I will really appreciate it.
The web did not make me any wiser.
Im running SpamAssassin v2.6 and MailScanner v4.23 .
I have been receiving allot of spam from people where the From: address
contain my company's address
eg. [EMAIL PROTECTED] and the To: address contains eg. [EMAIL PROTECTED]
I need to drop all mail where the From: and To: contain @xyz.com
I created this rule, but it's been dropping allot of legal mail.
header __FAKE_FROM_MYCOMP from =~ /(\@)(xyz)/
header __FAKE_TO_MYCOMP to =~ /(\@)(xyz)/
meta FROM_MYCOMP_TO_MYCOMP (( __FAKE_FROM_MYCOMP + __FAKE_TO_MYCOMP) > 1)
score FROM_MYCOMP_TO_MYCOMP 20.0
Thanks in advance.
-Lean-
<mailto:[EMAIL PROTECTED]>
