Appending the modifier “:addr” to a header name will remove everything from 
that header except the first email address. If you are using an anchored regexp 
on the email address, then the From:addr test should work, i.e.

                header SPAM11OctF1   From:addr ~= 

But you are otherwise on to something there. If the airecom -address is not in 
the visible From: -line (“From: “), but instead in the Envelope sender (i.e. 
the “From “ line), then you should use the pseudoheader EnvelopeFrom in the SA 

                header SPAM11OctF1   EnvelopeFrom ~= 

The EnvelopeFrom pseudoheader contains just the email address without any 
surrounding < >.

man Mail::SpamAssassin::Conf is your friend.

--<>     GSM  +358-40-767 8282
Oy Arrak Software Ab

From: amavis-users [] 
On Behalf Of @lbutlr
Sent: Thursday, October 13, 2016 11:43 AM
Subject: Re: spam assassin rule to block a From address

On Oct 13, 2016, at 2:12 AM, Indunil Jayasooriya 
<<>> wrote:
what's the difference between From and From:addr ?

Isn’t From the “From “ and From:addr the “From:”?

Reply via email to