I figured out why my RETURNPATH rule was matching. My example was too sanitized and I was actually trying to find multiple domains in my regex. So it would always match due to the fact that it would always not equal the other domain I was looking for.
From: Erickarlo Porro <epo...@earthcam.com> Sent: Wednesday, March 20, 2024 10:02 AM To: users@spamassassin.apache.org Subject: RE: Help with rule matching when it shouldn't I want to catch “yahoo” anywhere in the header so that it matches if its in the name or in the address. So I would want to match ya...@gmail.com<mailto:ya...@gmail.com> Regarding "__RETURNPATH_IS", I have the rule set to “!~” so shouldn’t that rule only match if that header has anything but yahoo.com? I did notice that I had a typo when I wrote the email due to the period but my rule actually looks like this: header __RETURNPATH_IS Return-Path !~ /yahoo\.com$/i My intention is to find emails that have a specific company name in the From header but the return path does not include their domain. So like in my theoretical example, if someone emails me from ya...@gmail.com<mailto:ya...@gmail.com> and the return path does include yahoo.com then don’t match but if someone emails me from ya...@othercompany.com<mailto:ya...@othercompany.com> but the return path does not include yahoo.com, match my rule. From: Jimmy <thana...@gmail.com<mailto:thana...@gmail.com>> Sent: Tuesday, March 19, 2024 7:45 PM To: users@spamassassin.apache.org<mailto:users@spamassassin.apache.org> Subject: Re: Help with rule matching when it shouldn't The correct syntax for the header rule should be: header __FROM_ADDRESS From:addr =~ /\@yahoo\.com/i This rule will specifically match email addresses containing "@yahoo.com<http://yahoo.com>" while excluding addresses like "ya...@gmail.com<mailto:ya...@gmail.com>". Regarding the example provided, the "__RETURNPATH_IS" rule should indeed be triggered since it matches "yahoo.com<http://yahoo.com>" in the return-path. If you're uncertain about the intended behavior of the rules, please clarify the requirements so we can adjust the rules accordingly. Jimmy On Wed, Mar 20, 2024 at 4:52 AM Erickarlo Porro <epo...@earthcam.com<mailto:epo...@earthcam.com>> wrote: Could someone help me figure out why my custom rule is matching when it should not be matching? This is my current setup: header __FROM_ADDRESS From =~ /yahoo/i header __RETURNPATH_IS Return-Path !~ /yahoo.com<http://yahoo.com>$/i meta NOT_IT (__FROM_ADDRESS && __RETURNPATH_IS) describe NOT_IT Sender is not correct score NOT_IT 4.0 Take these headers as an exmaple: From: ya...@gmail.com<mailto:ya...@gmail.com> Return-path: ya...@yahoo.com<mailto:ya...@yahoo.com> If I send an email that would have those headers Spamassassin is getting a hit for my NOT_IT rule but that should not match because __RETURNAPTH_IS should not get a hit. How can I troubleshoot this?
