Whitelisting problems

[Gary Faith]

Finally, getting close to figuring this out but I could really use some help here.  I figured out part of the issues was spamassassin was caching data and I had to delete the cache to get it to process the rules for this message.
 
I created these three spamassassin rules:
 
# Rule to find Whitelist Blackberry mail
header    FROM_BLACKBERRY       From =~ /\.*\.us\.blackberry\.com/
score     FROM_BLACKBERRY       -10
describe  FROM_BLACKBERRY       email From blackberry user

header COM_DOMAIN_MAIL From =~ /\.com/i
score COM_DOMAIN_MAIL 0.1
header NET_DOMAIN_MAIL From =~ /\.net/i
score NET_DOMAIN_MAIL 0.1

Here is the problem now.  The meessage is being sent
 
From: srs0=jc450o=la=mydomain.net=gafaith at srs.bis6.us.blackberry.com

and in the Spam report, I get:
 

-0.50BAYES_00Bayesian spam probability is 0 to 1%
0.10NET_DOMAIN_MAIL 
1.53RATWARE_EFROMBulk email fingerprint (envfrom) found
-0.00SPF_PASSSPF: sender matches SPF record
 
It should match the FROM_BLACKBERRY and the COM_DOMAIN_MAIL rule but instead it matches the NET_DOMAIN_MAIL rule.  It looks like it is matching on the first instance of a domain instead of what is after the @ sign.
 
Maybe with this information someone can tell me why it is doing this and what I can do to have it match the us.blackberry.com.
 
Thanks in advance,
 
Gary


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20130107/418681e9/attachment.html