(This is a continuance of http://forum.firetrust.com/viewtopic.php?p=113033)
We're looking to perform general comparisons of the domain component ONLY of the following 3 fields:
From
X-Sender
Reply-To
We are wanting to increase the Bayesian spam value by 100 every time one of the domain values don't match. So, then, if all 3 fields contain differing domains, then we would be adding 300 (A<>B, A<>C, B<>C).
Please note that we are *NOT* white-listing or black-listing, we need to simply compare everything after the "@" in those addresses. However, we can find no capability for MailWasher spam filtering to compare a partial value from one string against a partial value from a different string.
It was mentioned that REGEX filters can be used to do this, but from what I can see, you can only use a REGEX filter to compare perform a true/false tests against one field (i.e. "Does the REGEX [@(\w+\.)+\w+] match on the From field"), but you can't use a REGEX filter to compare against the results of a different REGEX-determined value (i.e. "Does the REGEX [@(\w+\.)+\w+] value returned from the From field match the REGEX [@(\w+\.)+\w+] value returned from the Reply-To field").
Can someone please assist with some details?
Custom Mailwasher Filters: compare portion of one field to portion of another field
- rusticdog
- Firetrust Monkey
Post
Re: Custom Mailwasher Filters: compare portion of one field to portion of another field
Unfortunately that's not going to be possible as MailWasher just runs simple expressions over the fields, and cannot compare results.
The guts to put a domain comparison together is all there under the hood, so it's an interesting thought. X headers are a slight complication given they vary across servers though.
The guts to put a domain comparison together is all there under the hood, so it's an interesting thought. X headers are a slight complication given they vary across servers though.
- DanAtCCD
- Travelling Tuatara
Post
Re: Custom Mailwasher Filters: compare portion of one field to portion of another field
Thanks for the reply. This is exactly the conclusion I had come to, but I had a very experienced user assert that it was do-able, without providing details.
Some other day, with some other version, maybe.
Some other day, with some other version, maybe.