[horde] Regular Expression Filter of recipients

[Philippe Faure]

Hello Neils,

I managed to get a few more details.  The system is using Cyrus-Sieve  
configuration. Which should support regex. I have also checked the  
spam filter and it is working.

I have also completed several tests and it would seem that if you do a  
search the content of "To:" it only seems to search the actual email  
address, and not the whole string: "John doe" <me at you.com>.  From what  
I can tell the search function only search <me at you.com>, and not "John  
Doe".

To me, that doesn't make sense, Is this correct? All the examples that  
I have found online only show examples of the actual email address and  
not the associated name. IS this correct?

Thank you

Philippe





Quoting Niels Dettenbach <nd at syndicat.com>:

> It depends from which filter driver you are using for ingo (i assume  
> you mean ingo with filtering) - afaik not all drivers are regex  
> capable.
>
> I.e. if you filter with ingo / SIEVE (we mainly use SIEVE / Cyrus)  
> you have to consult the SIEVE specification for regex details and  
> the SIEVE documentation of your Mailers SIEVE subsystem if and how  
> far it provides SIEVE and SIEVE regexes. Same may happen if you are  
> using procmailrc or others where the regexes are to interpret by the  
> mailer.
>
> If filters are not working in general you have to check too that  
> your ingos backend is working.
>
> Without any technical details about the ingo backend in use probably  
> no one could help you here.
>
> If you really think such a delete rule is a good idea - other options are:
>  - to add a (i.e. more general) rule to your anti spam subsystem  
> (for all users?) or
>  - to the mailer (MTA/LDA) directly.
>
> I'm just wondering if you currently get such kind of spam through if  
> you really have a working spam filter - in system's i've seen such  
> stuff is filtered out with typically high scores by other reasons.  
> Another trick is/was to "encode" some chars within a email address  
> to bypass special regex filters (but no mailer should accept such  
> stuff).
>
> So i would recommend to review your mailer and spam filter solution,  
> tuning or give him further data sources - especially if you plan to  
> delete spam without any bounce or manual on review on one AND you  
> rely on email communication on the other hand.
>
> Cheers,
>
> Niels.
> ---
> http://www.dettenbach.de
>
>