I figured out why my RETURNPATH rule was matching. My example was too sanitized and I was actually trying to find multiple domains in my regex. So it would always match due to the fact that it would always not equal the other domain I was looking for.
From: Erickarlo Porro <eporro@earthcam.com>
Sent: Wednesday, March 20, 2024 10:02 AM
To: users@spamassassin.apache.org
Subject: RE: Help with rule matching when it shouldn't
I want to catch “yahoo” anywhere in the header so that it matches if its in the name or in the address. So I would want to match yahoo@gmail.com<mailto:yahoo@gmail.com>
Regarding "__RETURNPATH_IS", I have the rule set to “!~” so shouldn’t that rule only match if that header has anything but yahoo.com? I did notice that I had a typo when I wrote the email due to the period but my rule actually looks like this:
header __RETURNPATH_IS Return-Path !~ /yahoo\.com$/i
My intention is to find emails that have a specific company name in the From header but the return path does not include their domain. So like in my theoretical example, if someone emails me from yahoo@gmail.com<mailto:yahoo@gmail.com> and the return path does include yahoo.com then don’t match but if someone emails me from yahoo@othercompany.com<mailto:yahoo@othercompany.com> but the return path does not include yahoo.com, match my rule.
From: Jimmy <thanadon@gmail.com<mailto:thanadon@gmail.com>>
Sent: Tuesday, March 19, 2024 7:45 PM
To: users@spamassassin.apache.org<mailto:users@spamassassin.apache.org>
Subject: Re: Help with rule matching when it shouldn't
The correct syntax for the header rule should be:
header __FROM_ADDRESS From:addr =~ /\@yahoo\.com/i
This rule will specifically match email addresses containing "@yahoo.com<
http://yahoo.com>" while excluding addresses like "yahoo@gmail.com<mailto:yahoo@gmail.com>".
Regarding the example provided, the "__RETURNPATH_IS" rule should indeed be triggered since it matches "yahoo.com<
http://yahoo.com>" in the return-path. If you're uncertain about the intended behavior of the rules, please clarify the requirements so we can adjust the rules accordingly.
Jimmy
On Wed, Mar 20, 2024 at 4:52?AM Erickarlo Porro <eporro@earthcam.com<mailto:eporro@earthcam.com>> wrote:
Could someone help me figure out why my custom rule is matching when it should not be matching?
This is my current setup:
header __FROM_ADDRESS From =~ /yahoo/i
header __RETURNPATH_IS Return-Path !~ /yahoo.com<
http://yahoo.com>$/i
meta NOT_IT (__FROM_ADDRESS && __RETURNPATH_IS)
describe NOT_IT Sender is not correct
score NOT_IT 4.0
Take these headers as an exmaple:
From: yahoo@gmail.com<mailto:yahoo@gmail.com>
Return-path: yahoo@yahoo.com<mailto:yahoo@yahoo.com>
If I send an email that would have those headers Spamassassin is getting a hit for my NOT_IT rule but that should not match because __RETURNAPTH_IS should not get a hit.
How can I troubleshoot this?