This is working pretty well so far. Thanks for you help with this. I would like to enhance it to cater for the situations where I am not in the "To" address (e.g. I am in CC: to Bcc: or the "mailing list" situation.
How would I do a test of the form: If To: email address contains ernstoff.net then check for To: real name contains Mike or Michael or is blank? > From: Mike Spamassassin [mailto:[EMAIL PROTECTED] >> >> > From: Mike Spamassassin [mailto:[EMAIL PROTECTED] >> >> >> >> I have seen a rule to identify that the "From" address does not >> >> have a "real name", which I presume is the description (i.e. in >> >> my case "Mike Spamassassin"). I would like to have a rule which >> >> identifies emails where the "To" address does not contain either >> >> "Mike" or "Michael". Has anyone created a similar rule, or can >> >> anyone point me in the right direction. >> > >> > As has been pointed out before, this is generally a bad idea. >> > There are lots of newsletters and mailing lists (including this >> > one) that do not put your name in the "To" field. >> > >> > If you want to try it, you can use a rule such as this: >> > >> > header NOT_MY_NAME To:name !~ /\b(?:Mike|Michael)\b/i >> > score NOT_MY_NAME 0.5 >> > describe NOT_MY_NAME To does not contain Mike or Michael >> > >> > Adjust the score to your liking. Don't put it too high until you >> > are sure it's not going to produce too may false positives. >> > >> > If you do this, you may need to whitelist some of your mailing >> > lists and newsletters. >> >> Thanks for your help. >> I will try this out, and see how it goes. >> Presumably it could be amended to check for Mike, Michael or blank to >> avoid the problem you mentioned. >> I will look up the regular expression syntax and see if I can >> suss it out. > > I'm not quite sure how to check for the absence of a real name. I > guess I could go find the rule that checks the From line, but I'm too > lazy at the moment. :) > > This might work: > > header NOT_MY_NAME To:name !~ /\b(?:Mike|Michael)\b|^$/i > > It is still susceptible to false positives, tho. How about this > example: > > To: "Mailing List" <[EMAIL PROTECTED]> > > Since SA uses Perl regular expressions, these two pages may be useful: > > Perl Regular Expressions Quick Start > http://perldoc.perl.org/perlrequick.html > > Perl Regular Expressions Tutorial > http://perldoc.perl.org/perlretut.html > > Bowie > >
