On Wed, 2019-12-04 at 14:22 -0800, Chris Mulcahy wrote: > Actually, I want it to score if there ISN’T a match. If I get an email > addressed to slashdot....@example.com from an address that isn’t from > slashdot, it’s likely spam. > > Currently, I am doing like you mentioned with a bunch of individual > rules > that look like this: > header __CRM_FAMAZON From =~ /amazon/i > header __CRM_TAMAZON To =~ /amazon/i > meta CRM_AMAZON (!__CRM_FAMAZON && __CRM_TAMAZON) > describe CRM_AMAZON amazon in to address but not from > score CRM_AMAZON 1.5 > > But I have to edit the rules every time I find a new one that comes > in. I failed to keep the list because at the time I never anticipated > spam would be as prevalent as it is. > > I did grab your solution and will look through it. It may make this a > less painful process. > Merely using an list of alternative regexes in the rule should make life easier than writing a whole set of subrules - and will almost certainly run faster. Just reversing the comparison should do it If there isn't a negated version of =~ (and I can't remember if there is one), use a subrule:
header __ALT_TEST From:addr ~= /(alt1|alt2|....)/ meta SPAMBLOCK ( !__ALT_TEST ) score SPAMBLOCK -0.5 This should give the non-matches a small nudge towards hamminess. Martin > Thanks, > Chris
