I have a a reject rule inside body_checks parameter written like this:

/(\d{3,4},\d{2} EUR)/ REJECT Body Spam Rule 934

This regexp paramater should be ok, at least according to some testing pages where you can test regexp, for example on this page. So, I test it against this sentence

Sie haben eine Zahlung über 156,36 EUR

But when I test with real e-mail containing above sentences, the email is not rejected.

Postfix has enabled header and body checks. Other non regexp rules works fine. I have also reloaded postfix service after adding filter to body_checks. Any idea why?

  • 1
    Can you post applicable postfix configuration files? – user87664 Nov 26 '14 at 21:58
  • Any idea how to copy the whole content of .cf file threw ssh? :P – gappani Nov 26 '14 at 22:11
  • You need post all lines in your body_checks file. Maybe some regexp rules overriding this regexp. Try to place the regexp above the others. – masegaloeh Nov 27 '14 at 5:10
  • All lines are inside body_checks file. main.cf references to body checks files threw header_checks = regexp:/etc/postfix/body_checks. I also moved rule above all rules, but the problem remains. – gappani Nov 27 '14 at 10:00
  • 1
    Is this a test email you created or a real spam email from a spammer? If it's a spammer email, it could easily contain different characters such as a tab instead of a space or a non-printable character or alternate unicode characters such as the fullwidth digits (U+FF1x). – Ladadadada Nov 27 '14 at 11:22

Looks like postfix doesn't support\d in regex. Replace it with [0-9] to make it work.

/([0-9]{3,4},[0-9]{2} EUR)/ REJECT Body Spam Rule 934

Postmap result

~$ postmap -bmq - regexp:/etc/postfix/myregex  < sample-body
Sie haben eine Zahlung über 156,36 EUR  REJECT Body Spam Rule 93156,36 EUR
  • thank you, thank you 100 times :). You made my day. It works now!!! – gappani Nov 28 '14 at 11:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.