0

I have a a reject rule inside body_checks parameter written like this:

/(\d{3,4},\d{2} EUR)/ REJECT Body Spam Rule 934

This regexp paramater should be ok, at least according to some testing pages where you can test regexp, for example on this page. So, I test it against this sentence 

Sie haben eine Zahlung über 156,36 EUR

But when I test with real e-mail containing above sentences, the email is not rejected.

Postfix has enabled header and body checks. Other non regexp rules works fine. I have also reloaded postfix service after adding filter to body_checks. Any idea why?

Improve this question
5
  • 1
    Can you post applicable postfix configuration files?
    – user87664
    Nov 26, 2014 at 21:58
  • Any idea how to copy the whole content of .cf file threw ssh? :P
    – gappani
    Nov 26, 2014 at 22:11
  • You need post all lines in your body_checks file. Maybe some regexp rules overriding this regexp. Try to place the regexp above the others.
    – masegaloeh
    Nov 27, 2014 at 5:10
  • All lines are inside body_checks file. main.cf references to body checks files threw header_checks = regexp:/etc/postfix/body_checks. I also moved rule above all rules, but the problem remains.
    – gappani
    Nov 27, 2014 at 10:00
  • 1
    Is this a test email you created or a real spam email from a spammer? If it's a spammer email, it could easily contain different characters such as a tab instead of a space or a non-printable character or alternate unicode characters such as the fullwidth digits (U+FF1x).
    – Ladadadada
    Nov 27, 2014 at 11:22

1 Answer 1

Reset to default
4

Looks like postfix doesn't support\d in regex. Replace it with [0-9] to make it work.

/([0-9]{3,4},[0-9]{2} EUR)/ REJECT Body Spam Rule 934

Postmap result

~$ postmap -bmq - regexp:/etc/postfix/myregex  < sample-body
Sie haben eine Zahlung über 156,36 EUR  REJECT Body Spam Rule 93156,36 EUR
Improve this answer
1
  • thank you, thank you 100 times :). You made my day. It works now!!!
    – gappani
    Nov 28, 2014 at 11:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .