Thank you, everyone. I added in the space to have the filter be formatted: /^Received: from foo.domain/
and that has been working. I also added in the other two just to be safe in case the first didn't catch it. I appreciate the help! Randy ----- Original Message ----- From: "Viktor Dukhovni" <postfix-us...@dukhovni.org> To: postfix-users@postfix.org Sent: Monday, March 30, 2015 10:42:48 PM Subject: Re: Header Filtering On Mon, Mar 30, 2015 at 09:40:10AM -0400, Paul Hoffman wrote: > > Received: from foo.domain > > > > /^Received:from foo.domain/ WARN smtp test #spam rule SMTP test Right, this was missing a space after the "Received:" header name. > Try /^Received:\s+from\s+foo\.domain\b/ ... So the above is better, but "\b" is not ideal, because a literal "." is also a word-boundary. Thus: Try (switching to reserved the .example TLD): /^Received:\s+from\s+domain\.example\s+/ ... because there will always be more text after the domain, e.g. the final newline if nothing else. -- Viktor.