> Of course that should be:
>
> describe SCC_MIME_BOGUSCT1 Bogus /mixed Content-Type
> header SCC_MIME_BOGUSCT1 Content-Type =~ /^(?<!multipart)\/mixed/
> score SCC_MIME_BOGUSCT1 2>Hmmm... For some reason I do not understand, the anchor doesn't work, >so: Bill the negative lookbehind does not consume positions within the analysis, try something like: Content-Type =~ /(?<!\bmultipart)\/mixed/ -------Pedro
