Cool.  Thanks.

On 6/12/2020 11:04 AM, Kris Deugau wrote:
AJ Weber wrote:
I want to try adding a score for a sender whose address uses a TLD with  > 3 chars.

I realize there are some legit ones, but I'm going to test it with a low score and see what it catches.

Is it just something like:
header   From =~   /\.\w{4,}$/

You'll probably want to use the :addr specifier to match only on the actual address:

header LONG_TLD    From:addr /\.\w{4,}$/

Otherwise your rule won't match much mail at all unless the From: header consists of a completely bare email address.

-kgd

Reply via email to