Thank you Giovanni, I'll give this rule a try. I think the bigger issue was that the default welcomelist was shortcircuiting any further rule evaluation. Now I'm able to score these emails with rules like this one :)
On Tue, Nov 15, 2022 at 2:44 AM <giova...@paclan.it> wrote: > On 11/14/22 21:14, Shawn Iverson wrote: > > How do I stop this? paypal.com <http://paypal.com> is in the default > DKIM whitelist! > > Does this work on your sample ? > The body you posted is only partial. > > uri __URI_IMG_PAYPAL > /^https:\/\/www\.paypalobjects\.com\/(?:digitalassets|en_US|ui\-web)\/.{1,64}\.(?:gif|jpg|png)/ > meta __PAYPAL_IMG_NOT_RCVD_PAYP __URI_IMG_PAYPAL && > !__HDR_RCVD_PAYPAL > meta GB_PAYPAL_IMG_NOT_RCVD_PAYP __PAYPAL_IMG_NOT_RCVD_PAYP && > !__HAS_ERRORS_TO && !__MSGID_LIST && !__MSGID_GUID && !__RCD_RDNS_SMTP > describe GB_PAYPAL_IMG_NOT_RCVD_PAYP Paypal hosted image but message > not from Paypal > score GB_PAYPAL_IMG_NOT_RCVD_PAYP 2.500 # limit > > Giovanni >
