Something along the following still seems the easiest to read approach to me
enlist_uri_host (BADTLDS) vn enlist_uri_host (BADTLDS) pl enlist_uri_host (BADTLDS) my enlist_uri_host (BADTLDS) lu enlist_uri_host (BADTLDS) ar header __TEST_URLS eval:check_uri_host_listed('BADTLDS') Paul From: Robert Boyl <robertb...@gmail.com> Date: Friday, 15 September 2017 at 17:48 To: "users@spamassassin.apache.org" <users@spamassassin.apache.org> Subject: Re: Ends with string Hi! Thanks! I didnt find this info in Writing rules tutorial. I see uri __KAM_SHORT /(\/|^|\b)(?:j\.mp|bit\.ly|goo\.gl|x\.co|t\.co|t\.cn|tinyurl\.com|hop\.kz|urla\.ru|fw\.to)(\/|$|\b)/i Seems a bit complicated. It would be to make this rule check that suffixes are at the end of URI. uri __TEST_URLS /\b(\.vn|\.pl|\.my|\.lu|\.vn|\.ar)\b/i I believe this does it, correct? uri __TEST_URLS /\b(\.vn$|\.pl$|\.my$|\.lu$|\.vn$|\.ar$)\b/i Thanks. Rob -- Paul Stead Systems Engineer Zen Internet