On 11/21/2011 1:30 PM, Sergio wrote: > Unfortunately, it seems that MCP doesn't like the rule: > > header __ENV_FROM_DHL Received =~ /envelope-from [^ > @]+@dhl(?:[-_][^ .]+)?\.com/i > header __FROM_DHL From =~ /\bdhl(?:[-_][^ .]+)?\.com/i > header __ENV_FROM_UPS Received =~ /envelope-from [^ > @]+@ups\.com/i > > header __FROM_UPS From =~ /\bups\.com/i > meta DHL_UPS_MISMATCH (__ENV_FROM_DHL && __FROM_UPS) || > (__ENV_FROM_UPS && __FROM_DHL) > describe DHL_UPS_MISMATCH virus DHL-USA or UPS > score DHL_UPS_MISMATCH 11 > > When I wrote this to the MPC rules file, none of my other rules work.
I'm not sure if escaping the "@" symbols is required or not, but try this: header __ENV_FROM_DHL Received =~ /envelope-from [^ \@]+\@dhl(?:[-_][^ .]+)?\.com/i header __ENV_FROM_UPS Received =~ /envelope-from [^ \@]+\@ups\.com/i -- Bowie
