Appending the modifier “:addr” to a header name will remove everything from 
that header except the first email address. If you are using an anchored regexp 
on the email address, then the From:addr test should work, i.e.

                header SPAM11OctF1   From:addr ~= 
/^airecom612\+97d7d60a91d9695c9a4240f92d5c3cae\@/i

But you are otherwise on to something there. If the airecom -address is not in 
the visible From: -line (“From: “), but instead in the Envelope sender (i.e. 
the “From “ line), then you should use the pseudoheader EnvelopeFrom in the SA 
test:

                header SPAM11OctF1   EnvelopeFrom ~= 
/^airecom612\+97d7d60a91d9695c9a4240f92d5c3cae\@/i

The EnvelopeFrom pseudoheader contains just the email address without any 
surrounding < >.

man Mail::SpamAssassin::Conf is your friend.

--
kai.ri...@arrak.fi<mailto:kai.ri...@arrak.fi>     GSM  +358-40-767 8282
Oy Arrak Software Ab   http://www.arrak.fi



From: amavis-users [mailto:amavis-users-bounces+kai.risku=arrak...@amavis.org] 
On Behalf Of @lbutlr
Sent: Thursday, October 13, 2016 11:43 AM
To: amavis-users@amavis.org
Subject: Re: spam assassin rule to block a From address

On Oct 13, 2016, at 2:12 AM, Indunil Jayasooriya 
<induni...@gmail.com<mailto:induni...@gmail.com>> wrote:
what's the difference between From and From:addr ?

Isn’t From the “From “ and From:addr the “From:”?

Reply via email to