Ruben Cardenal wrote: > > How could a rule score catch those 3 things at a time? I know how to do it > for the headers part (someone in this lists told me how), but I don't know > how to relate that line of the body with the "To" part of the headers. I > mean, the "john" word in that line of the body matches the "john" word in > the "To". I hope I've explained myself enough :) Thanks for any suggestions > about this.
Correlating headers to body text can be done, but it's not practical... 1) you can use a "full" rule with the /s option and backtracking (i.e. \1). This is *horribly* slow, and memory hungry. For a non-matching message SA is going to have to check every byte of the complete message, including all attachments. Backreferences are expensive, that's why we normally use (:? instead of ( for most things. Full rules are expensive. Put the two together and you have a very expensive rule. 2) you can write a perl plugin for spamassassin that does this. Unfortunately, this is a fair amount of work. Given 1 and 2, this generally isn't very practical. It's certainly not practical enough to be worth the effort when there are better ways. Realistically, I'd be more apt to try to match the presence of a short "Subject" header in the body text and meta that with the numeric real subject header.
