<HTML><HEAD>
<META content="text/html; charset=utf-8" http-equiv=Content-Type>
<META name=GENERATOR content="MSHTML 8.00.7601.17744"></HEAD>
<BODY style="MARGIN: 4px 4px 1px; FONT: 10pt Segoe UI">
<DIV>Dennis,</DIV>
<DIV> </DIV>
<DIV>I tried both:</DIV>
<DIV> </DIV>
<DIV>header FROM_BLACKBERRY From =~ /\.us\.blackberry\.com/<BR>header FROM_BLACKBERRY From =~ /.*\.us\.blackberry\.com/<BR></DIV>
<DIV>but it still doesn't match the rule.</DIV>
<DIV> </DIV>
<DIV>Gary<BR><BR>>>> Denis Beauchemin <Denis.Beauchemin@usherbrooke.ca> 1/7/2013 9:54 AM >>><BR>Gary,<BR><BR>This rule is wrong:<BR>header FROM_BLACKBERRY From =~ /\.*\.us\.blackberry\.com/<BR><BR>It should read:<BR>header FROM_BLACKBERRY From =~ /\.us\.blackberry\.com/<BR><BR>Rethinking about your rule, I'm not so sure anymore it was wrong because the part I removed \.* would match any number of periods, from zero to infinity. I'm pretty sure you don't have to match the complete from, but if you wanted to you would rewrite your rule this way:<BR>header FROM_BLACKBERRY From =~ /.*\.us\.blackberry\.com/<BR><BR>Denis<BR><BR><BR>De : mailscanner-bounces@lists.mailscanner.info [mailto:mailscanner-bounces@lists.mailscanner.info] De la part de Gary Faith<BR>Envoyé : 7 janvier 2013 09:13<BR>À : mailscanner@lists.mailscanner.info<BR>Objet : Re: Whitelisting problems<BR><BR>Finally, getting close to figuring this out but I could really use some help here. I figured out part of the issues was spamassassin was caching data and I had to delete the cache to get it to process the rules for this message.<BR><BR>I created these three spamassassin rules:<BR><BR># Rule to find Whitelist Blackberry mail<BR>header FROM_BLACKBERRY From =~ /\.*\.us\.blackberry\.com/<BR>score FROM_BLACKBERRY -10<BR>describe FROM_BLACKBERRY email From blackberry user<BR>header COM_DOMAIN_MAIL From =~ /\.com/i<BR>score COM_DOMAIN_MAIL 0.1<BR>header NET_DOMAIN_MAIL From =~ /\.net/i<BR>score NET_DOMAIN_MAIL 0.1<BR>Here is the problem now. The meessage is being sent<BR><BR>From: srs0=jc450o=la=mydomain.net=gafaith@srs.bis6.us.blackberry.com<BR><BR>and in the Spam report, I get:<BR><BR>-0.50<BR>BAYES_00<BR>Bayesian spam probability is 0 to 1%<BR>0.10<BR>NET_DOMAIN_MAIL<BR><BR>1.53<BR>RATWARE_EFROM<BR>Bulk email fingerprint (envfrom) found<BR>-0.00<BR>SPF_PASS<BR>SPF: sender matches SPF record<BR><BR>It should match the FROM_BLACKBERRY and the COM_DOMAIN_MAIL rule but instead it matches the NET_DOMAIN_MAIL rule. It looks like it is matching on the first instance of a domain instead of what is after the @ sign.<BR><BR>Maybe with this information someone can tell me why it is doing this and what I can do to have it match the us.blackberry.com.<BR><BR>Thanks in advance,<BR><BR>Gary<BR><BR>-- <BR>MailScanner mailing list<BR>mailscanner@lists.mailscanner.info<BR><A href="http://lists.mailscanner.info/mailman/listinfo/mailscanner">http://lists.mailscanner.info/mailman/listinfo/mailscanner</A><BR><BR>Before posting, read <A href="http://wiki.mailscanner.info/posting">http://wiki.mailscanner.info/posting</A><BR><BR>Support MailScanner development - buy the book off the website! <BR></DIV></BODY></HTML>