<HTML><HEAD>
<META content="text/html; charset=utf-8" http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 8.00.7601.17744"></HEAD>
<BODY style="MARGIN: 4px 4px 1px; FONT: 10pt Segoe UI">
<DIV>Finally, getting close to figuring this out but I could really use some help here. I figured out part of the issues was spamassassin was caching data and I had to delete the cache to get it to process the rules for this message.</DIV>
<DIV> </DIV>
<DIV>I created these three spamassassin rules:</DIV>
<DIV> </DIV>
<DIV><EM># Rule to find Whitelist Blackberry mail<BR>header FROM_BLACKBERRY From =~ /\.*\.us\.blackberry\.com/<BR>score FROM_BLACKBERRY -10<BR>describe FROM_BLACKBERRY email From blackberry user<BR></EM></DIV>
<DIV><EM>header COM_DOMAIN_MAIL From =~ /\.com/i<BR>score COM_DOMAIN_MAIL 0.1</EM></DIV>
<DIV><EM>header NET_DOMAIN_MAIL From =~ /\.net/i<BR>score NET_DOMAIN_MAIL 0.1<BR></EM></DIV>
<DIV>Here is the problem now. The meessage is being sent</DIV>
<DIV> </DIV>
<DIV>From: <A href="mailto:srs0=jc450o=la=mydomain.net=gafaith@srs.bis6.us.blackberry.com">srs0=jc450o=la=mydomain.net=gafaith@srs.bis6.us.blackberry.com</A><BR><BR>and in the Spam report, I get:</DIV>
<DIV> </DIV>
<DIV>
<TABLE class=sa_rules_report border=0 cellSpacing=2 cellPadding=1 width="100%">
<TBODY>
<TR>
<TD align=left>-0.50</TD>
<TD width=200>BAYES_00</TD>
<TD>Bayesian spam probability is 0 to 1%</TD></TR>
<TR>
<TD>0.10</TD>
<TD>NET_DOMAIN_MAIL</TD>
<TD> </TD></TR>
<TR>
<TD align=left>1.53</TD>
<TD width=200>RATWARE_EFROM</TD>
<TD>Bulk email fingerprint (envfrom) found</TD></TR>
<TR>
<TD align=left>-0.00</TD>
<TD width=200>SPF_PASS</TD>
<TD>SPF: sender matches SPF record</TD></TR></TBODY></TABLE></DIV>
<DIV> </DIV>
<DIV>It should match the FROM_BLACKBERRY and the COM_DOMAIN_MAIL rule but instead it matches the NET_DOMAIN_MAIL rule. It looks like it is matching on the first instance of a domain instead of what is after the @ sign.</DIV>
<DIV> </DIV>
<DIV>Maybe with this information someone can tell me why it is doing this and what I can do to have it match the us.blackberry.com.</DIV>
<DIV> </DIV>
<DIV>Thanks in advance,</DIV>
<DIV> </DIV>
<DIV>Gary</DIV>
<DIV><BR><BR></DIV></BODY></HTML>