-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
[EMAIL PROTECTED] writes:
> > Is there a way to only test the first "received from" in the header?
> > For a "received from unknown" rule, I only want to test the machine
> > that contacted my mail server, not any preceding ones.
> >
> > TIA,
> > Russ
>
> Hmmm... perhaps a
> header FIRST_RECEIVED_BY ALL =~
> /(?!^Received-By: [.\n]*)^Received-By: (?:your pattern here)$/im
>
> would do the trick. The /m lets ^ and $ match internally to the header
> list. "."s won't match newlines.
Also, the pseudo-header "X-Spam-Relays-Untrusted" can be used to
match this. It appears in this format:
[ helo=... ip=... rdns=... .... ] [ helo=... ip=... rdns=... .... ]
...
each "hop" is a [ ...] block. So to match the first hop, look
for the pattern and exclude all "]" chars.
- --j.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Exmh CVS
iD8DBQFAac8TQTcbUG5Y7woRAol0AKDoKAU/jBA4ZEH/o943jGUgGQ9OswCgn+W5
Ghy7vpwPjfs9gTdrtQo8OJ0=
=TyQw
-----END PGP SIGNATURE-----
