spamassassin-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From John Hardin <jhar...@impsec.org>
Subject Re: Two types of new spam
Date Sat, 04 Jan 2020 18:58:26 GMT
On Fri, 3 Jan 2020, RW wrote:

> On Fri, 3 Jan 2020 15:29:40 -0700
> Philip Prindeville wrote:
>
>>> On Jan 3, 2020, at 11:34 AM, RW <rwmaillists@googlemail.com> wrote:
>>>
>>> On Fri, 3 Jan 2020 10:09:21 -0800 (PST)
>>> John Hardin wrote:
>
>>>> Try this instead, to actually match the header(s):
>>>>
>>>>   header __L_RECEIVED_SPF       Received-SPF =~ /^./
>>>
>>> That should be:
>>>
>>> header __L_RECEIVED_SPF       Received-SPF =~ /^./m
>>
>>
>> Seems to work either way!
>
> Either should match, but without the /m it should only match once.
>
> I just tried it and
>
> meta   L_RECEIVED_SPF     (__L_RECEIVED_SPF >= 10)
>
> doesn't work without the /m in  __L_RECEIVED_SPF

Odd. I'll have to check that out. Perhaps SA is collapsing multiple 
headers into a single line internally.

-- 
  John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
  jhardin@impsec.org    FALaholic #11174     pgpk -a jhardin@impsec.org
  key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
   Anyone who uses the word "profit" as a dirty word should be
   watched very, very carefully. If they hate the idea of gain
   through free trade it can only mean that they’re looking to
   get it through robbery.                             -- Lyle@Ultimak
-----------------------------------------------------------------------
  305 days until the Presidential Election
Mime
  • Unnamed multipart/mixed (inline, None, 0 bytes)
View raw message