Firetrust Support Forums

this is the header i got.
Received: from mx05.back.prod.mail.online.nl (LHLO mx05.online.nl)
(10.160.210.165) by mailstore01.back.prod.mail.online.nl with LMTP; Wed, 3
Aug 2011 17:47:58 +0200 (CEST)
Received: from localhost (filterin09.back.prod.mail.online.nl [10.160.210.229])
by mx05.online.nl (Postfix) with ESMTP id 8FA0510008;
Wed, 3 Aug 2011 17:47:58 +0200 (CEST)
Received: from mx01.online.nl ([10.160.210.161])
by localhost (filterin09.back.prod.mail.online.nl [10.160.210.247]) (amavisd-new, port 10024)
with ESMTP id 1+jTev2ylyPI; Wed, 3 Aug 2011 17:47:58 +0200 (CEST)
Received: from mx01.online.nl (localhost [127.0.0.1])
by mx01.online.nl (Postfix) with ESMTP id 675B986004;
Wed, 3 Aug 2011 17:47:53 +0200 (CEST)
Received: from 194.134.42.41 (unknown [89.46.72.76])
by mx01.online.nl (Postfix) with SMTP;
Wed, 3 Aug 2011 17:47:52 +0200 (CEST)
Received: from 102.154.64.246 by 14.98.25.175; Wed, 03 Aug 2011 12:37:13 -0400
Message-ID: <Z17C7IBS75K86@arbitrate.prostrate.se>
From: "Uhren" <xjfjuzlhtg@cnn.com>

i want to filter on cnn.com like this.
The from contains @cnn.com (what the case is)
Regular expression does NOT contain Received: from.+(cnn\.com) (what the case is)

however, when parsing the header in the test field, and do a test on the expresion.
it finds the cnn.com in the from field, and that is not what i want.
becouse of that the filter is not working, how can i fix this.

so, i wonder...what goes wrong ..
perhaps a idea for a next version,adding a Received tag. xD