Skip to main content

Spam email matching multiple criterea and actions

rusty99
As an end user I have many rules to trap spam and it traps pretty well all of it. I get on average 80 spam messages a day in the Global Email Filters that covers four email accounts on a personal domain name. The issue I'm having is that there is more than one actions as an email may match different criteria for different purposes. I have a folder GLOBAL SPAM where I review what's been captured to make sure my filters aren't capturing legitimate mail, but once I identify a single troublesome source I make a rule that sends that to dev/null. For example, there are a lot of TLDs like .shop and .store that carry spam so I use .+@.+\.shop to capture it and send it to dev/null. The only problem is it seems to also send a copy to the GLOBAL SPAM folder which seems to defeat the purpose. The .+@.+\.shop to dev/null is the first item in the rules list, so I was hoping it would send to dev/null before other processing. Can someone enlighten me on whether this is true of what is happening and what I might be able to do about it? Save message to: /dev/null 0660 Deliver message to: "+GLOBAL SPAM" Filtering set up at least one significant delivery or other action. No other deliveries will occur.

Comments

4 comments

Date Votes
  • cPRex Jurassic Moderator
    Hey there! I'm not sure we have enough details to answer this. Could we get a screenshot of the filters you have setup? Can you let me know where the last portion of that text came from?
    0
  • rusty99
    I've too many filters and criteria in place to screenshot as I've built up the capture list over 10 years. The last few lines (base of original post above) are the results from the Filter Test field on the Global Email Filters page. It states that the sample email tested meets multiple criteria. I was hoping there was some way of having say the first criteria enacted and then no other actions after that. But after multiple testing I see that the same emails captured by the 'Save message to: /dev/null 0660' filter, are also delivered to the designated spam folder. So it seems to be an AND result. So doing a test of a spam email about fungal nails, it has the .shop sender, which is very easy to isolate and send to dev/null, but it also has an ABUSE SURBL which goes to the spam folder and also has fungal in the reply field to which also goes to the spam folder. untitled text 4:49: Sub-condition is true: $message_headers matches .+@.+\\.shop untitled text 4:598: Sub-condition is true: $message_headers contains ABUSE SURBL untitled text 4:599: Condition is true: $header_from: contains fungal In summary, I want to send any email with a dodgy TLD such as .shop and .store and a dozen other useless TLDs that are used to send to spam, directly to dev/null, and any others not with those TLDs to the spam folder where I can double-check before deleting. I'm an end user with a commercial hosting company so I don't have access or skills to create complex conditions in a text file somewhere, but it would be good to have some way of sending known troublesome emails to dev/null even if they match other multiple criteria, so it would be like: If sender ends in TLD of .shop or .loan or .bid etc Send to dev/null Do not process further If sender doesn't end in TLD of .shop or .loan or .bid etc Process remaining filters ----- Hope this makes sense.
    0
  • cPRex Jurassic Moderator
    I believe you've found the key to this earlier when you mentioned this:
    So it seems to be an AND result.

    As long as you're using one giant Global Filter rule, it will be AND processing, so it can match on multiple criteria. Now, you can change this in a new filter by adjusting the and/or dropdown on the right side of the page, highlighted in red here: but it would require a separate filter file. What you *can't* do is what you're looking for, which is an if/then statement, as the filters just aren't that advanced.
    0
  • rusty99
    Thanks for that. I use about half a dozen filter files (i need to clean up and reduce this number) and there is no AND/OR option between them it seems, just a default AND. At least I have a better understanding as originally I thought my regex was failing. Spam is such a pest and the filtering I use is very effective but I guess the email filters weren't necessarily designed as a spam solution.
    0

Please sign in to leave a comment.

Didn't find what you were looking for?

New post