370
Recipient
Use this option to match the recipient (To header).
Message header
Allows you to examine an arbitrary mail header.
Message body
The actual contents of the email are analyzed when selecting this value.
Rule
This setting differs from the previous ones. It allows you to modify the score of SX-
GATE's builtin rules. Accordingly you don't specify a search pattern here. Instead
you have to supply the internal ID of the rule. The ID together with the original
score is listed in the content analysis of mails, that have been marked as SPAM
(e.g. "HTML_MESSAGE" or "FORGED_MUA_OUTLOOK").
When the builtin rulesets are updated, internal ID's may
change without notice. The rules defined here will not be
adjusted.
Search patterns ("matches") are case-insensitive. Some characters have a special
meaning:
* (Asterisk)
It represents a sequence of arbitrary characters. The sequence may also be
missing. As searching for such a sequence of any length is rather time-consuming,
an asterisk matches no more than 30 characters. The pattern "a*d" will match e.g.
"ad", "a_d" and "abcd".
? (Question mark)
Any single character is matched by a question mark. If for instance "a?d" is looked
up, "a_d" is a hit. In contrast "ad" and "abcd" do not apply.
_ (Underscore)
An underscore matches any amount of whitespace characters, i.e. spaces, tabs
and new-lines. As an example, "a_d" will match "a d", but not "ad" or "a_d".
Please keep an eye on the configured thresholds when selecting the score for a new
rule. For a rule which refers to SPAM mails you have to select a positive value. Negative
numbers reduce the probability of matching emails to be classified as SPAM.
SPAM filter whitelist
Of course the SPAM mail filter will not achieve a hit ratio of 100% when classifying
emails automatically. If an email was identified as SPAM by mistake, you can add the
sender to this list. The SPAM filter will subtract 100 points from the SPAM score of a
mail, if the sender is found in this list. Thus all future emails of senders listed here will
never be recognised as SPAM.
