On Sat, 13 Jan 2018, Alex wrote:

From: "F*e dE x" <fedexdispatchl...@speedpost.com>

That address hardly resembles "Fed Ex", but how general of a rule can
we create and still catch variations such as this?

I thought something like this would work:

header    FUZZY_FEDEX   From =~
/(?!f.?e.?d.{0,3}e.?x)<F>.?<E>.?<D>.{0,3}<E>.?<X>/i

To fully debug this, I think we need to know the replace_tag
definitions you've set for these characters.  That said, the first
thing I notice is that the negative lookahead pattern matches your
From header (twice, I think).  This means that no matter what follows,
this rule will not trigger.  I suspect you want the negative lookahead
to be more strictly correct, like "(?!fed ex)".

You may also want to use "From:name =~" to limit the search to the
non-address portion of the header.


--
Public key #7BBC68D9 at            |                 Shane Williams
http://pgp.mit.edu/                |      System Admin - UT CompSci
=----------------------------------+-------------------------------
All syllogisms contain three lines |              sha...@shanew.net
Therefore this is not a syllogism  | www.ischool.utexas.edu/~shanew

Reply via email to