HOW TO: Using Regexp "AND with OR" rules, and testing 'TO' field value

This section contains user-submitted tutorials.
Post Reply
User avatar
Posts: 8914
Joined: 2011-09-08 17:48

HOW TO: Using Regexp "AND with OR" rules, and testing 'TO' field value

Post by jimimaseye » 2016-02-02 21:36

Quite often a RULE is needed to check on a list of required or banned values (ie, an 'AND' match) whilst in conjunction and forming a list of other conditions that may need an 'OR' match.

if TO = GEOFF@mydomain and
(FROM contains Customer1 or FROM contains Customer2)

Hmailserver does not allow this combination. However using REGEXP you can supply the list (OR's) in a single test value to achieve the result

The following is a little hint that will help you use REGEXP to create a test against a list of values.

1, To test a field for a positive match against containing a list of values

ie, if field contains "THIS" or contains "THAT or contains "ANOTHER"

  • if field contains
    *THIS* or
    *THAT* or
The following test will suffice:

2, To test a field to ensure it DOES NOT contain a list of values

ie, does not contain 'THIS' and does not contain 'THAT' and does not contain 'ANOTHER'

  • if field
    is not *THIS* and
    is not *THAT* and
    is not *ANOTHER*

Note1: the list values are separated with a pipe symbol " | ". Extra list values can be added using this separator symbol.
Note2: the letter "i" (3rd character of the expression) specifies that the text match is NOT case dependant. Removal of "i" will make it case dependant.

TIP about TO:
Often people see that entering the field "TO" to be tested (eg, where "TO = 'name@domain.tld'") doesnt actually work against the email values (therefore fail a match). You will find that doing either of the following 3 options may work:

a, instead of using 'predefined field' TO, you should use 'RECIPIENT LIST' or
b, 'predefined field' TO CONTAINS (instead of 'equals') or
c, instead of using 'predefined field' TO, you should use CUSTOMER HEADER FIELD "TO".

option (b) works because email address fields (such as FROM and TO) often come in with the form "displayname <name@domain.tld>" and it is this value including name alias and the the angle brackets that is tested. (In other words: "" is NOT the same as "displayname <>"). Specifying CONTAINS will find the actual address within.

option (c) is particularly useful when collecting emails by External Download (rather than direct SMTP delivery) as it reads the physical 'TO:' header of the email rather than the actual account that is collecting the email (which may be different).

In Practice:

So to use the opening example, the Rule could be written as
  • if TO CONTAINS "GEOFF@mydomain" and
    FROM REGEXP (?i:^.*(Customer1|Customer2).*$)
5.7 on test.
SpamassassinForWindows 3.4.0 spamd service
AV: Clamwin + Clamd service + sanesecurity defs :

Post Reply