Why do you need to match them at the same time? Using meta would be more effective. Also this doesn't care what order From and To appear in headers.
header __FOO1 From =~ /pedro/i header __FOO2 To =~ /pedro/i meta FOO __FOO1 && __FOO2 But just to put it out there, if you want to capture and match things from another header, proper way would be with positive lookaheads, header order won't matter then. This finds pedro from To:. header FOO ALL =~ /^(?=.*?\nFrom:[^\n]*(pedro))(?=.*?\nTo:[^\n]*\1)/si On Thu, Dec 06, 2018 at 09:29:40PM +0000, Pedro David Marco wrote: > Thanks Benny, > > if your rule worked, it would only match FROM or TO... the great advantage of > the ALL is that i "sees" all headers in one string so we can match FROM > 'and' > TO at the same time > > ------ > PedroD > > > > On Thursday, December 6, 2018, 10:23:17 PM GMT+1, Benny Pedersen > <[email protected]> > wrote: > > > Pedro David Marco skrev den 2018-12-06 21:25: > > > > header TESTRULE2 ALL =~ /From=.*pedro.* > > To=.*pedro.*/ism > > This is a mistery... :-? > > > header TESTRULE (From|To) =~ /\.*pedro\.*/ism > > dont know if it works, just my silly thinking right now >
