On Sun, 27 Dec 2020 10:17:15 -0800 (PST) John Hardin wrote:
> To catch those you'd need to check for the address in a Received: > header, assuming your MTA adds the envelope recipient to the > Received: header it generates. > You might do: > > header ABUSED_PLUS Received =~ /\bfor > <shiva[+.](?:abused1|abused2)\@sewingwitch\.com>/i This isn't completely reliable as the MTA wont provide the envelope recipient when there's more than one in the same SMTP session. It may be good enough for a single user mail system though. I presume this isn't trivial to fix as Fastmail had an unreliable X-Delivered-to header for years. Without a reliable envelope recipient, the best you can do is use all the sources of addresses, something like the following (untested): header ABUSED_PLUS All =~ /^(?:(?:To|Cc):\s(?:.*(?:,\s|<))?|Received:.*for\s<)(?:shiva[+.](?:abused1|abused2)\@sewingwitch\.com)[,>\s\n]/im
