On Mon, 24 Aug 2020, Martin Gregorie wrote:

On Mon, 2020-08-24 at 11:51 -0700, John Hardin wrote:
Might want some \b in there, just to be safe. The from check would
also
hit domains like "amazon-river.org". Perhaps:

  header SUBRULE13a From:name =~ /\bAmazon\b/
  header SUBRULE13b From:addr =~ /\bamazon\.com$/

Indeed

meta   SUBRULE13  (SUBRULE13a != SUBRULE13b)

That seems too broad, you're assuming mail from amazon.com always has
"amazon" in the sender name. Perhaps:

   meta  SUBRULE13  SUBRULE13a && !SUBRULE13b

Also true.

What I *thought* I was doing was:

Sorry, I can't help doing that. :)


--
 John Hardin KA7OHZ                    http://www.impsec.org/~jhardin/
 jhar...@impsec.org                         pgpk -a jhar...@impsec.org
 key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C  AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
  Our politicians should bear in mind the fact that
  the American Revolution was touched off by the then-current
  government attempting to confiscate firearms from the people.
-----------------------------------------------------------------------
 Today: the 1941st anniversary of the destruction of Pompeii

Reply via email to