If I understand you then you are looking at a subject line that looks
like this in the raw mail file.
Subject: " This would be tagged as spam"
This would render in email programs as a subject including the quotes:
" This would be tagged as spam"
The normal subject header begins with the first non-blank character after
the "Subject:" part. That means the "\"" character is the first character
in the subject not the " " character. So if you want to catch the specific
subject you cited then you must use a rule like, I believe:
header X_QUOTE_SUBJECT Subject =~ /\b\"\bThis would be tagged as spam\"/i
{^_^}
----- Original Message -----
From: "Matthew Yette" <[EMAIL PROTECTED]>
Hmm maybe I wasn't all that clear..
When I wrote quotes, it was just to imply the actual subject. I'm
looking to detect messages that have a space before the first letter of
the subject.
--
Matthew Yette
Senior Engineer - NOC/Operations
MA Polce Consulting, Inc.
[EMAIL PROTECTED]
315-838-1644 (w)
315-356-0597 (f)
AIM/Yahoo: MAPolceNOC
MSN: [EMAIL PROTECTED]
-----Original Message-----
From: Theo Van Dinter [mailto:[EMAIL PROTECTED]
On Fri, Aug 05, 2005 at 03:09:50PM -0400, Matthew Yette wrote:
> Does anyone know how I would create a rule that detected any subject
> lines that start with a whitespace? For example:
>
> Subject: " This would be tagged as spam"
By convention, all subjects start with whitespace.
"Subject: Re: Rule for ..." starts with a space, for example.
In your example, the subject starts with a double-quote, which isn't
whitespace. If you are looking for a subject that starts with
non-alphanumeric characters, you could just do:
header T_FOO Subject =~ /^\s?\W/
Or something.
--
Randomly Generated Tagline:
"This is turning into one very sexy struggle for the human race."
-Zapp Brannigan
