That was the error, the @ has to be escaped \@, now it is working. Thank you all for your help on this rule.
Regards, Sergio On Mon, Nov 21, 2011 at 1:16 PM, Bowie Bailey <bowie_bai...@buc.com> wrote: > On 11/21/2011 1:30 PM, Sergio wrote: > > Unfortunately, it seems that MCP doesn't like the rule: > > > > header __ENV_FROM_DHL Received =~ /envelope-from [^ > > @]+@dhl(?:[-_][^ .]+)?\.com/i > > header __FROM_DHL From =~ /\bdhl(?:[-_][^ > .]+)?\.com/i > > header __ENV_FROM_UPS Received =~ /envelope-from [^ > > @]+@ups\.com/i > > > > header __FROM_UPS From =~ /\bups\.com/i > > meta DHL_UPS_MISMATCH (__ENV_FROM_DHL && __FROM_UPS) || > > (__ENV_FROM_UPS && __FROM_DHL) > > describe DHL_UPS_MISMATCH virus DHL-USA or UPS > > score DHL_UPS_MISMATCH 11 > > > > When I wrote this to the MPC rules file, none of my other rules work. > > I'm not sure if escaping the "@" symbols is required or not, but try this: > > header __ENV_FROM_DHL Received =~ /envelope-from [^ > \@]+\@dhl(?:[-_][^ .]+)?\.com/i > header __ENV_FROM_UPS Received =~ /envelope-from [^ > \@]+\@ups\.com/i > > -- > Bowie >
