I ran some tests which indicate one may not have subsequent '-' after 'X-' in header lines:
given this "message": X-SpamASN: AS3701 140.211.0.0/16 X-Spam-ASN: AS3701 140.211.0.0/16 body... and those rules: header _LOCAL_XAS1 X-SpamASN =~ /AS3701 / describe _LOCAL_XAS1 Sender IP in AS from friendly SA user score _LOCAL_XAS1 -0.1 header _LOCAL_XAS2 X-Spam-ASN =~ /AS3701 / describe _LOCAL_XAS2 Sender IP in AS from friendly SA user score _LOCAL_XAS2 -0.1 _LOCAL_XAS1 matches and _LOCAL_XAS2 does not: pts rule name description ---- ---------------------- -------------------------------------------------- -0.1 _LOCAL_XAS1 Sender IP in AS from friendly SA user -0.0 NO_RELAYS Informational: message was not relayed via SMTP 1.6 SUBJ_ALL_CAPS Subject is all capitals 1.2 MISSING_HEADERS Missing To: header 0.1 MISSING_MID Missing Message-Id: header -0.0 NO_RECEIVED Informational: message has no Received headers 1.4 MISSING_DATE Missing Date: header 0.0 NO_HEADERS_MESSAGE Message appears to be missing most RFC-822 headers perhaps this might be worth a bug report. -- Christian Recktenwald spamassassin-talk-d...@citecs.de