> or I create a short > custom rule.
fine. :) Do it
header __L_FROM_1 From =~ /[EMAIL PROTECTED]/i header __L_RCVD_1 Received =~ /example\.com/i meta L_BL_FROM_RCVD1 (__L_FROM_1 && __L_RVCD_1) describe L_BL_FROM_RCVD1 blacklist from and received example.com score L_BL_FROM_RCVD1 10.0
Done.
(note: I didn't test it, so it might have a typo, but logicaly, that's the correct way to write a rule to do it. Modify the search regexes as needed.)
