<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<span style="white-space: pre-wrap">
</span>
<blockquote type="cite"
cite="mid:CAB1R3shv2R0jswY-2J7kqy7XybfqAwGmyG+F2C=qvZWufM1foQ@mail.gmail.com"><span
style="white-space: pre-wrap">
</span>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">I was using the hash-type arrays. Would something like this work for the
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">hash array to represent any sender at this domain?
'.email.avi-8.com' => -100.0,
</pre>
</blockquote>
Yes, but I was under the impression that you wanted to match
VERP-style sender addresses, specifically.<br>
<blockquote type="cite"
cite="mid:CAB1R3shv2R0jswY-2J7kqy7XybfqAwGmyG+F2C=qvZWufM1foQ@mail.gmail.com"><br>
<blockquote type="cite">
<pre class="moz-quote-pre" wrap="">Apr 19 17:21:23 xavier amavis[679593]: (679593-18)
{"@timestamp":"2024-04-19T21:21:22.452Z","action":["DISCARD","PASS"],"actions_performed":"DiscardedInbound
RelayedInbound Quarantined","attached_file_names":["message.msg"],"author":<a class="moz-txt-link-rfc2396E" href="mailto:watchrecon.com@gmail.com">"watchrecon.com@gmail.com"</a>]
Looks like a multi-recipient mail, where one of the recipients triggered a
Discard+Quarantine and the other a Pass.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">
Ah, yes, that looks like the case. I have an always_bcc user being used
here, but it never used to be quarantined, even when the other recipient
was.
I traced the message to the final recipient, and he did receive it, but the
bcc-user did not. What could have changed?
</pre>
</blockquote>
Are you sure? I am not able to reproduce that. Your logline
indicates that you log the report_json. Please check `action` and
`ccat_main` of your bcc recipient in the report's `recipients`
structure.<br>
</body>
</html>