> Its not conditional, just using a meta rule and negating the Reply-to > test in the meta: > > describe FORGED_HOTMAIL Hotmail with non-Hotmail Reply-to address > header __FORGED_HM1 From ~= /\...@hotmail\.com/i > header __FORGED_HM2 Reply-to ~= /\...@hotmail\.com/i > meta FORGED_HOTMAIL (__FORGED_HM1 && !__FORGED_HM2) > score FORGED_HOTMAIL 5.0 > > and write cookie cutter rules for Yahoo and Gmail. > > OTOH if you're happy that a Japanese test won't generate FPs you can > cover all three ISPs with one rule: > > describe FORGED_FROM Hotmail,Yahoo or Google with Japanese Reply-to > header __FF1 From ~= /\@(hotmail|yahoo|gmail)\.com/i > header __FF2 Reply-to ~= /\.jp/i > meta FORGED_FROM (__FF1 && __FF2) > score FORGED_FROM 5.0
Thanks Martin. This is actually far simpler then I was thinking it would be. --Dennis
