On Fri, 2 Sep 2016 09:31:41 +0000 Nicola Piazzi wrote: > header RELAYCOUNTRY_IT X-Relay-Countries =~ /IT/ > header RELAYCOUNTRY_BAD X-Relay-Countries > =~ /^(US|CN|RU|UA|JP|HK|UK|DE|BR|IN)/ > > in some cases I have both results in the spam report, I suppose that > is because plugin evals all ip address end not lastexterlal, is it > correct ?
No, it's because you didn't have a ^ before IT. > is there a way to check only lastexternal ? any suggestion ? For me it's better to score according to the least wanted country in the list rather than the first, it does depend on your circumstances though. Usually it's easiest to do this with meta rules. > then there is a problem adding the header, I never found it in my > header how is possible that the rule find it ? SA creates pseudoheaders to hold metadata. The headers rules run on both real headers and pseudoheaders. Adding a header in the output is not necessary, but it can be added like other headers are added using the appropriate tag. This is well documented.
