> Some emails that I'm getting have no subject lines in them at all. I
> would like to build a SA filter where:
>
> header NOSUBJECT_LINE !/Subject: /
> score NOSUBJECT_LINE 5.0
>
> but will ! act as a negator?
Nope, not like that. There are a couple of ways to do this.
However, I want to mention that no subject *by itself* is perfectly legit,
and isn't a good reason to toss out an email. Now, no subject AND no body,
or no subject AND no to or cc; those would be good reasons to toss out a
mail as spam. If you look at what you are getting it probably matches one
or both of those cases if it is spam.
First, the correct general syntax for a header test would be:
header TESTNAME Subject =~ /something/
You could do a negated version of the test (ie: one that fires if
'something' is NOT in the subject0 with:
header MYTEST !~ /something/
However, you might want to know if the Subject header even exists. You can
do a
header ISITTHERE Subject:Exists
NOTE that you can have a "subject" header, but still not have a subject --
that is, the subject will be blank.
Probably the safest test for "is there a Subject header, and does it have at
least one non-blank character" would be:
header NONBLANK_SUB Subject =~ /\S/ (or you might want to use
/\w/)
Since having a subject is a good thing, you could use a meta to negate it,
and possibly combine it with other tests:
header __REALSUB Subject =~/\w/
header __TO_SOMEONE ToCC =~ /\w/
body __SOMEBODY /\S/
meta EMPTY_HEADED (!__REALSUB && !__SOMEBODY && !__TO_SOMEONE)
score EMPTY_HEADED 5
Loren
