Let test.eml be a complete e-mail, and let test-body.eml be the body of test.eml only.
The following matches any e-mail body with a single link surrounded by spaces and newlines: perl -n0e '/\A\s*<https?:\/\/[^>]+\s*\z/mi and print' test-body.eml Therefore, we add the following to postfix's body_checks: /\A\s*<https?:\/\/[^>]+\s*\z/A REJECT UCE: Body with single link only The resulting postmap, however, matches any e-mail body with links and surrounding text, returning nasty false positives: postmap -q - pcre:/etc/postfix/body_checks <test.eml The difference between patterns is dictated by postfix's adaptation of pcre and its defaults: despite the specification, postfix is ignoring \A, \z and /A. Note for the lazy ----------------- man 5 pcre_table: > i (default: on) > Toggles the case sensitivity flag. By default, matching is > case insensitive. > m (default: off) > Toggles the PCRE_MULTILINE flag. When this flag is on, > the ^ and $ metacharacters match immediately after and > immediately before a newline character, respectively, > in addition to matching at the start and end > of the subject string. > A (default: off) > Toggles the PCRE_ANCHORED flag. When this flag is on, the > pattern is forced to be "anchored", that is, it is constrained > to match only at the start of the string which is being searched > (the "subject string"). This effect can also be achieved by > appropriate constructs in the pattern itself. postfix-3.0.3/README_FILES/PCRE_README: > When Postfix searches a pcre: or regexp: lookup table, > each pattern is applied to the entire input string.
