On Mon, Mar 30, 2015 at 09:40:10AM -0400, Paul Hoffman wrote:
> > Received: from foo.domain
> >
> > /^Received:from foo.domain/ WARN smtp test #spam rule SMTP test
Right, this was missing a space after the "Received:" header name.
> Try /^Received:\s+from\s+foo\.domain\b/ ...
So the above is better, but "\b" is not ideal, because a literal
"." is also a word-boundary. Thus:
Try (switching to reserved the .example TLD):
/^Received:\s+from\s+domain\.example\s+/ ...
because there will always be more text after the domain, e.g.
the final newline if nothing else.
--
Viktor.
