Here is what I have crafted so far -

# Check for bad RE[ tag
header BAD_RE_TAG Subject =~ /\b"Re"\[\b/i
score BAD_RE_TAG 6.0

# Check for bad Re: tag
header BAD_RECOLON_TAG Subject =~ /\b"Re:"\b/i
score BAD_RECOLON_TAG 6.0

While the first rule should stop the cialis spam from coming through
that the other rules aren't, I am concerned about the second rule
stopping email with something past the Re:.  Is my concern valid and how
do I allow the email to get through that has something after Re: ?

Thanks,
Ron

--------------------------------------------------------------------
Ron Nutter                          [EMAIL PROTECTED] 
Network Infrastructure & Security Manager
Information Technology Services                        (502)863-7002
Georgetown College                                     
Georgetown, KY                                            40324-1696
--------------------------------------------------------------------
 

-----Original Message-----
From: Matt Kettler [mailto:[EMAIL PROTECTED] 
Sent: Thursday, September 15, 2005 11:17 AM
To: Ronald I. Nutter; users@spamassassin.apache.org
Subject: RE: Spam with Re[2]: or Re[4]:


At 11:11 AM 9/15/2005, Ronald I. Nutter wrote:

>I am trying to write a rule to block these based on subject line but 
>keep getting regex errors.  It seems to be related to trying to put in 
>the [ character/symbol.  Can someone provide an example of how they did

>it?

You'd need to escape any [ or ] with a \ so put \[ instead of just [


Reply via email to