On Sat, 19 Nov 2011 05:42:43 -0600 Sergio wrote:
> header VIRUS_DHL2 ALL =~ /text inside the email to check for/i This looks for the text in all of the headers. If you meant to look in the body, then you want: body VIRUS_DHL2 /text inside the email to check for/i You should also consider naming the sub-rules with two leading underscore (like __VIRUS_DHL2), or explicitly score them, to prevent then having a one point default score.
