spam assassin rule to block a From address

[Kai Risku]

Appending the modifier “:addr” to a header name will remove everything from that header except the first email address. If you are using an anchored regexp on the email address, then the From:addr test should work, i.e.

                header SPAM11OctF1   From:addr ~= /^airecom612\+97d7d60a91d9695c9a4240f92d5c3cae\@/i

But you are otherwise on to something there. If the airecom -address is not in the visible From: -line (“From: “), but instead in the Envelope sender (i.e. the “From “ line), then you should use the pseudoheader EnvelopeFrom in the SA test:

                header SPAM11OctF1   EnvelopeFrom ~= /^airecom612\+97d7d60a91d9695c9a4240f92d5c3cae\@/i

The EnvelopeFrom pseudoheader contains just the email address without any surrounding < >.

man Mail::SpamAssassin::Conf is your friend.

--
Kai.Risku at arrak.fi<mailto:Kai.Risku at arrak.fi>     GSM  +358-40-767 8282
Oy Arrak Software Ab   http://www.arrak.fi



From: amavis-users [mailto:amavis-users-bounces+kai.risku=arrak.fi at amavis.org] On Behalf Of @lbutlr
Sent: Thursday, October 13, 2016 11:43 AM
To: amavis-users at amavis.org
Subject: Re: spam assassin rule to block a From address

On Oct 13, 2016, at 2:12 AM, Indunil Jayasooriya <indunil75 at gmail.com<mailto:indunil75 at gmail.com>> wrote:
what's the difference between From and From:addr ?

Isn’t From the “From “ and From:addr the “From:”?

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.amavis.org/pipermail/amavis-users/attachments/20161014/20b72aef/attachment.html>