> Is there a way to only test the first "received from" in the header? > For a "received from unknown" rule, I only want to test the machine > that contacted my mail server, not any preceding ones. > > TIA, > Russ
Hmmm... perhaps a header FIRST_RECEIVED_BY ALL =~ /(?!^Received-By: [.\n]*)^Received-By: (?:your pattern here)$/im would do the trick. The /m lets ^ and $ match internally to the header list. "."s won't match newlines. [EMAIL PROTECTED] 805.964.4554 x902 Hispanic Business Inc./HireDiversity.com Software Engineer perl -e"print join er,reverse',','l hack',' P','Just anoth'"
