Adi Nugroho wrote: > On Thursday 05 March 2009 23:44:39 Benny Pedersen wrote: > > header SELF_FROM From =~ /\...@my.address/i > > header SELF_TO To =~ /\...@my.address/i > > meta SELF (SELF_FROM && SELF_TO) > > describe SELF Trap mail with forged sender the same as recipient > > score SELF 3.0 > > Finally I understand above rule. > > First it check if the sender is my.address > then it check if the recipient is my.address > and finally, if both are true, then it give the score 3.0
Not quite. SELF_FROM and SELF_TO default to a score of 1. So it actually works like this: If the sender is my.address, score +1 If the recipient is my.address, score +1 If both are true, score +3 Final score = 5 If you don't want the sub-rules to score, you need to prefix the names with a double-underscore (this will also prevent them from showing in the rule summaries). header __SELF_FROM From =~ /\...@my.address/i header __SELF_TO To =~ /\...@my.address/i meta SELF (__SELF_FROM && __SELF_TO) describe SELF Trap mail with forged sender the same as recipient score SELF 3.0 -- Bowie
