sieve filter move wrong email to Junk folder

Previous Topic Next Topic
 
classic Classic list List threaded Threaded
11 messages Options
Gao
Reply | Threaded
Open this post in threaded view
|

sieve filter move wrong email to Junk folder

Gao
I use a sieve filter to move spam email to user's Junk folder:
# cat spam_to_junk.sieve
require "fileinto";
   if exists "X-Spam-Status" {
           if header :contains "X-Spam-Status" "YES" {
           fileinto "Junk";
           stop;
           } else {
       }
   }
   if header :contains "subject" ["SPAM?"] {
     fileinto "Junk";
     stop;
   }

Most time this filter works fine but occasionally it move non-spam in to
Junk folder. Here is an example, this email is from dovecot mailling
list and it end up in my Junk folder. Mailllog and header here. Would
someone help me to figure out what went wrong here?

Thanks.

Gao



=======Header=========
Dovecot Mailing List <[hidden email]>
References: <[hidden email]>
  <[hidden email]>
From: sender name <[hidden email]>
Message-ID: <[hidden email]>
Date: Thu, 14 Dec 2017 11:54:19 +0100
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101
  Thunderbird/52.5.0
MIME-Version: 1.0
In-Reply-To: <[hidden email]>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Content-Language: en-US
X-SA-Exim-Connect-IP: 217.119.239.130
X-SA-Exim-Mail-From: [hidden email]
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on sogo.guto.nl
X-Spam-Level:
X-Spam-Status: No, score=-2.9 required=5.0 tests=ALL_TRUSTED,BAYES_00
  autolearn=ham version=3.3.2, No
Subject: Re: New Dovecot service: SMTP Submission (RFC6409)
X-SA-Exim-Version: 4.2.1 (built Mon, 26 Dec 2011 16:24:06 +0000)
X-SA-Exim-Scanned: Yes (on sogo.guto.nl)
X-BeenThere: [hidden email]
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Dovecot Mailing List <dovecot.dovecot.org>
List-Unsubscribe: <https://dovecot.org/mailman/options/dovecot>,
  <mailto:[hidden email]?subject=unsubscribe>
List-Archive: <https://dovecot.org/pipermail/dovecot/>
List-Post: <mailto:[hidden email]>
List-Help: <mailto:[hidden email]?subject=help>
List-Subscribe: <https://dovecot.org/mailman/listinfo/dovecot>,
  <mailto:[hidden email]?subject=subscribe>
Errors-To: [hidden email]
Sender: "dovecot" <[hidden email]>
X-mydomain-MailScanner-Information: Please contact the administrator for
more information
X-mydomain-MailScanner-ID: D6773400AB09.ADBA7
X-mydomain-MailScanner: Found to be clean
X-mydomain-MailScanner-SpamCheck: not spam, SpamAssassin (not cached,
     score=-4.598, required 5, autolearn=not spam, BAYES_00 -1.90,
     DCC_CHECK 1.10, HEADER_FROM_DIFFERENT_DOMAINS 0.00,
     KAM_LAZY_DOMAIN_SECURITY 1.00, KAM_SHORT 0.00,
     RCVD_IN_DNSWL_MED -2.30, RCVD_IN_HOSTKARMA_W -2.50)
X-mydomain-MailScanner-From: [hidden email]

=====End of header=======



=======Maillog=========
Dec 14 02:54:51 mail postfix/postscreen[19236]: CONNECT from
[94.237.32.243]:40818 to [10.11.22.68]:25
Dec 14 02:54:52 mail postfix/postscreen[19236]: PASS OLD
[94.237.32.243]:40818
Dec 14 02:54:52 mail postfix/smtpd[19244]: connect from
wursti.dovecot.fi[94.237.32.243]
Dec 14 02:54:52 mail policyd-spf[19248]: None; identity=helo;
client-ip=94.237.32.243; helo=mail.dovecot.fi;
envelope-from=[hidden email]; receiver=[hidden email]
Dec 14 02:54:52 mail policyd-spf[19248]: None; identity=mailfrom;
client-ip=94.237.32.243; helo=mail.dovecot.fi;
envelope-from=[hidden email]; receiver=[hidden email]
Dec 14 02:54:52 mail postfix/smtpd[19244]: D6773400AB09:
client=wursti.dovecot.fi[94.237.32.243]
Dec 14 02:54:53 mail postfix/cleanup[19249]: D6773400AB09: hold: header
Received: from mail.dovecot.fi (wursti.dovecot.fi [94.237.32.243])??by
mail.mydomain.com (Postfix) with ESMTP id D6773400AB09??for
<[hidden email]>; Thu, 14 Dec 2017 02:54:52 -0800 (PST) from
wursti.dovecot.fi[94.237.32.243]; from=<[hidden email]>
to=<[hidden email]> proto=ESMTP helo=<mail.dovecot.fi>
Dec 14 02:54:53 mail postfix/cleanup[19249]: D6773400AB09:
message-id=<[hidden email]>
Dec 14 02:54:53 mail opendkim[1706]: D6773400AB09: wursti.dovecot.fi
[94.237.32.243] not internal
Dec 14 02:54:53 mail opendkim[1706]: D6773400AB09: not authenticated
Dec 14 02:54:53 mail opendkim[1706]: D6773400AB09: no signature data
Dec 14 02:54:53 mail postfix/smtpd[19244]: disconnect from
wursti.dovecot.fi[94.237.32.243] ehlo=1 mail=1 rcpt=1 data=1 quit=1
commands=5
Dec 14 02:54:53 mail MailScanner[18700]: New Batch: Scanning 1 messages,
7572 bytes
Dec 14 02:54:53 mail MailScanner[18700]: Virus and Content Scanning:
Starting
Dec 14 02:54:53 mail MailScanner[18700]: Spam Checks: Starting
Dec 14 02:54:53 mail MailScanner[18700]: MailWatch: Blacklist refresh
time reached
Dec 14 02:54:53 mail MailScanner[18700]: MailWatch: Starting up
MailWatch SQL Blacklist
Dec 14 02:54:53 mail MailScanner[18700]: MailWatch: Read 0 blacklist entries
Dec 14 02:54:56 mail MailScanner[18700]: Requeue: D6773400AB09.ADBA7 to
24EDE400AABD
Dec 14 02:54:56 mail MailScanner[18700]: Uninfected: Delivered 1 messages
Dec 14 02:54:56 mail postfix/qmgr[1756]: 24EDE400AABD:
from=<[hidden email]>, size=6784, nrcpt=1 (queue active)
Dec 14 02:54:56 mail MailScanner[18700]: Deleted 1 messages from
processing-database
Dec 14 02:54:56 mail MailScanner[18700]: MailWatch: Logging message
D6773400AB09.ADBA7 to SQL
Dec 14 02:54:56 mail MailScanner[18962]: MailWatch: D6773400AB09.ADBA7:
Logged to MailWatch SQL
Dec 14 02:54:56 mail dovecot: lmtp(19259): Connect from local
Dec 14 02:54:56 mail dovecot: lmtp([hidden email]):
AHqjGYBYMlo7SwAAlqGq+A: sieve:
msgid=<[hidden email]>: stored mail
into mailbox 'Junk'
Dec 14 02:54:56 mail dovecot: lmtp(19259): Disconnect from local:
Successful quit
Dec 14 02:54:56 mail postfix/lmtp[19258]: 24EDE400AABD:
to=<[hidden email]>, relay=mail.mydomain.com[private/dovecot-lmtp],
delay=3.9, delays=3.8/0.01/0.01/0.06, dsn=2.0.0, status=sent (250 2.0.0
<[hidden email]> AHqjGYBYMlo7SwAAlqGq+A Saved)
Dec 14 02:54:56 mail postfix/qmgr[1756]: 24EDE400AABD: removed
Dec 14 02:54:56 mail dovecot: indexer-worker([hidden email]): Indexed 1
messages in Junk (UIDs 11..11)
======End of Maillog======
Reply | Threaded
Open this post in threaded view
|

Re: sieve filter move wrong email to Junk folder

Richard-376


> Date: Thursday, December 14, 2017 09:47:44 -0800
> From: Gao <[hidden email]>
>
> I use a sieve filter to move spam email to user's Junk folder:
># cat spam_to_junk.sieve
> require "fileinto";
>    if exists "X-Spam-Status" {
>            if header :contains "X-Spam-Status" "YES" {
>            fileinto "Junk";
>            stop;
>            } else {
>        }
>    }
>    if header :contains "subject" ["SPAM?"] {
>      fileinto "Junk";
>      stop;
>    }
>
> Most time this filter works fine but occasionally it move non-spam
> in to Junk folder. Here is an example, this email is from dovecot
> mailling list and it end up in my Junk folder. Mailllog and header
> here. Would someone help me to figure out what went wrong here?
>
> Thanks.
>
> Gao
>

  > X-Spam-Status: No, score=-2.9 required=5.0
         tests=ALL_TRUSTED,BAYES_00


Because of the way you are bounding it, I suspect that the "YES" in
BAYES_00, at the end of that line, is triggering the mis-filing.

Why not make:

   contains "X-Spam-Status" "YES"

a single string:

   contains "X-Spam-Status: YES"

that would be more precise and avoid this issue.


Gao
Reply | Threaded
Open this post in threaded view
|

Re: sieve filter move wrong email to Junk folder

Gao
thank you for the advice. I'll change it.

Gao

On 2017-12-14 10:02 AM, Richard wrote:

>
>> Date: Thursday, December 14, 2017 09:47:44 -0800
>> From: Gao <[hidden email]>
>>
>> I use a sieve filter to move spam email to user's Junk folder:
>> # cat spam_to_junk.sieve
>> require "fileinto";
>>     if exists "X-Spam-Status" {
>>             if header :contains "X-Spam-Status" "YES" {
>>             fileinto "Junk";
>>             stop;
>>             } else {
>>         }
>>     }
>>     if header :contains "subject" ["SPAM?"] {
>>       fileinto "Junk";
>>       stop;
>>     }
>>
>> Most time this filter works fine but occasionally it move non-spam
>> in to Junk folder. Here is an example, this email is from dovecot
>> mailling list and it end up in my Junk folder. Mailllog and header
>> here. Would someone help me to figure out what went wrong here?
>>
>> Thanks.
>>
>> Gao
>>
>    > X-Spam-Status: No, score=-2.9 required=5.0
>           tests=ALL_TRUSTED,BAYES_00
>
>
> Because of the way you are bounding it, I suspect that the "YES" in
> BAYES_00, at the end of that line, is triggering the mis-filing.
>
> Why not make:
>
>     contains "X-Spam-Status" "YES"
>
> a single string:
>
>     contains "X-Spam-Status: YES"
>
> that would be more precise and avoid this issue.
>
>

Gao
Reply | Threaded
Open this post in threaded view
|

Re: sieve filter move wrong email to Junk folder

Gao
In reply to this post by Richard-376
Well I changed the line to
           if header :contains "X-Spam-Status: YES" {

Then I got:
# sievec spam_to_junk.sieve
spam_to_junk: line 3: error: the header test requires 2 positional
argument(s), but 1 is/are specified.
spam_to_junk: error: validation failed.
sievec(root): Fatal: failed to compile sieve script 'spam_to_junk.sieve'


Should it be:
           if header :contains "X-Spam-Status" "X-Spam-Status: YES" {

???
I need to learn some sieve grammar.

Gao

On 2017-12-14 10:02 AM, Richard wrote:

>
>> Date: Thursday, December 14, 2017 09:47:44 -0800
>> From: Gao <[hidden email]>
>>
>> I use a sieve filter to move spam email to user's Junk folder:
>> # cat spam_to_junk.sieve
>> require "fileinto";
>>     if exists "X-Spam-Status" {
>>             if header :contains "X-Spam-Status" "YES" {
>>             fileinto "Junk";
>>             stop;
>>             } else {
>>         }
>>     }
>>     if header :contains "subject" ["SPAM?"] {
>>       fileinto "Junk";
>>       stop;
>>     }
>>
>> Most time this filter works fine but occasionally it move non-spam
>> in to Junk folder. Here is an example, this email is from dovecot
>> mailling list and it end up in my Junk folder. Mailllog and header
>> here. Would someone help me to figure out what went wrong here?
>>
>> Thanks.
>>
>> Gao
>>
>    > X-Spam-Status: No, score=-2.9 required=5.0
>           tests=ALL_TRUSTED,BAYES_00
>
>
> Because of the way you are bounding it, I suspect that the "YES" in
> BAYES_00, at the end of that line, is triggering the mis-filing.
>
> Why not make:
>
>     contains "X-Spam-Status" "YES"
>
> a single string:
>
>     contains "X-Spam-Status: YES"
>
> that would be more precise and avoid this issue.
>
>

Reply | Threaded
Open this post in threaded view
|

Re: sieve filter move wrong email to Junk folder

Larry Rosenman
This is what I use with Exim, spam.sieve is included in from a master.sieve:

thebighonker.lerctr.org /home/ler $ more sieve/spam.sieve
require ["fileinto","imap4flags"];
if header :contains ["X-LERCTR-Spam-Flag","X-TNTSCAN-Spam-Flag"]  "YES"
{
   redirect "[hidden email]";
   fileinto :flags "\\Seen Junk" "SPAM";
   stop;
}

thebighonker.lerctr.org /home/ler $ grep -B10 -A10 -- -Spam-Flag /usr/local/etc/exim/configure
        spam = smmsp:true
  warn  message = X-LERCTR-Spam-Score: $spam_score ($spam_bar)
        ! authenticated = *
        spam = smmsp:true
  warn  message = X-Spam-Report: $spam_report
        ! authenticated = *
        spam = smmsp:true
  warn  message = X-LERCTR-Spam-Report: $spam_report
        ! authenticated = *
        spam = smmsp:true
  # Add X-Spam-Flag if spam is over system-wide threshold
  warn message = X-Spam-Flag: YES
        ! authenticated = *
        spam = smmsp:true
        condition = ${if >={$spam_score_int}{50}{1}{0}}
  warn message = X-LERCTR-Spam-Flag: YES
        ! authenticated = *
        spam = smmsp:true
        condition = ${if >={$spam_score_int}{50}{1}{0}}

  #warn  message = DomainKey-Status: $dkim_status
# !condition = ${if eq{$dkim_status}{}{1}{0}}
  # Reject spam messages with score over 7, using an extra condition.
  deny  message = This message scored $spam_score points. Congratulations!
        ! authenticated = *
        spam = smmsp:true
thebighonker.lerctr.org /home/ler $

On 12/14/17, 1:04 PM, "dovecot on behalf of Gao" <[hidden email] on behalf of [hidden email]> wrote:

    Well I changed the line to
               if header :contains "X-Spam-Status: YES" {
   
    Then I got:
    # sievec spam_to_junk.sieve
    spam_to_junk: line 3: error: the header test requires 2 positional
    argument(s), but 1 is/are specified.
    spam_to_junk: error: validation failed.
    sievec(root): Fatal: failed to compile sieve script 'spam_to_junk.sieve'
   
   
    Should it be:
               if header :contains "X-Spam-Status" "X-Spam-Status: YES" {
   
    ???
    I need to learn some sieve grammar.
   
    Gao
   
    On 2017-12-14 10:02 AM, Richard wrote:
    >
    >> Date: Thursday, December 14, 2017 09:47:44 -0800
    >> From: Gao <[hidden email]>
    >>
    >> I use a sieve filter to move spam email to user's Junk folder:
    >> # cat spam_to_junk.sieve
    >> require "fileinto";
    >>     if exists "X-Spam-Status" {
    >>             if header :contains "X-Spam-Status" "YES" {
    >>             fileinto "Junk";
    >>             stop;
    >>             } else {
    >>         }
    >>     }
    >>     if header :contains "subject" ["SPAM?"] {
    >>       fileinto "Junk";
    >>       stop;
    >>     }
    >>
    >> Most time this filter works fine but occasionally it move non-spam
    >> in to Junk folder. Here is an example, this email is from dovecot
    >> mailling list and it end up in my Junk folder. Mailllog and header
    >> here. Would someone help me to figure out what went wrong here?
    >>
    >> Thanks.
    >>
    >> Gao
    >>
    >    > X-Spam-Status: No, score=-2.9 required=5.0
    >           tests=ALL_TRUSTED,BAYES_00
    >
    >
    > Because of the way you are bounding it, I suspect that the "YES" in
    > BAYES_00, at the end of that line, is triggering the mis-filing.
    >
    > Why not make:
    >
    >     contains "X-Spam-Status" "YES"
    >
    > a single string:
    >
    >     contains "X-Spam-Status: YES"
    >
    > that would be more precise and avoid this issue.
    >
    >
   
   


Reply | Threaded
Open this post in threaded view
|

Re: sieve filter move wrong email to Junk folder

Bill Shirley
In reply to this post by Richard-376
This is what I use.  Notice the comma:
require "fileinto";
if header :contains "X-Spam-Status" "Yes," {
   fileinto "SystemFolders.SuspectedSpam";
   stop;
}

Bill

On 12/14/2017 1:02 PM, Richard wrote:

>
>> Date: Thursday, December 14, 2017 09:47:44 -0800
>> From: Gao <[hidden email]>
>>
>> I use a sieve filter to move spam email to user's Junk folder:
>> # cat spam_to_junk.sieve
>> require "fileinto";
>>     if exists "X-Spam-Status" {
>>             if header :contains "X-Spam-Status" "YES" {
>>             fileinto "Junk";
>>             stop;
>>             } else {
>>         }
>>     }
>>     if header :contains "subject" ["SPAM?"] {
>>       fileinto "Junk";
>>       stop;
>>     }
>>
>> Most time this filter works fine but occasionally it move non-spam
>> in to Junk folder. Here is an example, this email is from dovecot
>> mailling list and it end up in my Junk folder. Mailllog and header
>> here. Would someone help me to figure out what went wrong here?
>>
>> Thanks.
>>
>> Gao
>>
>    > X-Spam-Status: No, score=-2.9 required=5.0
>           tests=ALL_TRUSTED,BAYES_00
>
>
> Because of the way you are bounding it, I suspect that the "YES" in
> BAYES_00, at the end of that line, is triggering the mis-filing.
>
> Why not make:
>
>     contains "X-Spam-Status" "YES"
>
> a single string:
>
>     contains "X-Spam-Status: YES"
>
> that would be more precise and avoid this issue.
>
>

Reply | Threaded
Open this post in threaded view
|

Re: sieve filter move wrong email to Junk folder

Bill Shirley
Also, I wouldn't use the second rule:
     if header :contains "subject" ["SPAM?"] {
       fileinto "Junk";
       stop;
     }

If someone sends you an email with the subject "Can you help me with this spam?"
it will get filed into Junk.

Bill

Reply | Threaded
Open this post in threaded view
|

Re: sieve filter move wrong email to Junk folder

Steffen Kaiser-2
In reply to this post by Bill Shirley
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Fri, 15 Dec 2017, Bill Shirley wrote:

> This is what I use.  Notice the comma:
> require "fileinto";
> if header :contains "X-Spam-Status" "Yes," {
>   fileinto "SystemFolders.SuspectedSpam";
>   stop;
> }

I would even add the space:

if header :contains "X-Spam-Status" "Yes, " {

because the list of tests won't contain a space.

- --
Steffen Kaiser
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQEVAwUBWjOKB8QnQQNheMxiAQIdeAgAyL+FDM/DE5J1sRkJ6P8MuIAT3Zx8zfPO
Mljn/kswG551jyso2FfGqAw6et5uHrab3Wk22NxQVK6yR4ySZstr3RF9ICeuJVvs
pNFzyvBf0BivihWZLMWiVum0/B0LfpW6T7B93Yvbl/JXei2C6+uy8Mk2zFo/5jWP
lpKdIxWs/SMmsjFE2QccfP7Id1aUw+tYM+9P/fzc0/kGkNRs5UCodeo/e30opdvv
tJ8QpwPV/873uhk9p5m2NB/0bi4i9Rg5VMC2ui5trVlyOR2q2WpYVZ1gV2tvVpEA
B3QY8vrzDf9xb1zDoVi8hMDCqynZZGQ++nSfIux/7DBDJvvYx5sYKg==
=sUdv
-----END PGP SIGNATURE-----
Reply | Threaded
Open this post in threaded view
|

Re: sieve filter move wrong email to Junk folder

Alex JOST
In reply to this post by Gao
Am 14.12.2017 um 18:47 schrieb Gao:

> I use a sieve filter to move spam email to user's Junk folder:
> # cat spam_to_junk.sieve
> require "fileinto";
>    if exists "X-Spam-Status" {
>            if header :contains "X-Spam-Status" "YES" {
>            fileinto "Junk";
>            stop;
>            } else {
>        }
>    }
>    if header :contains "subject" ["SPAM?"] {
>      fileinto "Junk";
>      stop;
>    }
>
> Most time this filter works fine but occasionally it move non-spam in to
> Junk folder. Here is an example, this email is from dovecot mailling
> list and it end up in my Junk folder. Mailllog and header here. Would
> someone help me to figure out what went wrong here?

> X-Spam-Status: No, score=-2.9 required=5.0 tests=ALL_TRUSTED,BAYES_00
>   autolearn=ham version=3.3.2, No

AFAIK, header matching is case-insensitive. That's why 'YES' matches
'BAYES' and triggers the action.
--
Alex JOST
Reply | Threaded
Open this post in threaded view
|

Re: sieve filter move wrong email to Junk folder

Olaf Hopp
On 12/15/2017 02:36 PM, Alex JOST wrote:

> Am 14.12.2017 um 18:47 schrieb Gao:
>> I use a sieve filter to move spam email to user's Junk folder:
>> # cat spam_to_junk.sieve
>> require "fileinto";
>>    if exists "X-Spam-Status" {
>>            if header :contains "X-Spam-Status" "YES" {
>>            fileinto "Junk";
>>            stop;
>>            } else {
>>        }
>>    }
>>    if header :contains "subject" ["SPAM?"] {
>>      fileinto "Junk";
>>      stop;
>>    }
>>
>> Most time this filter works fine but occasionally it move non-spam in to Junk folder. Here is an example, this email is from dovecot mailling list and it end up in my Junk folder. Mailllog and header here. Would someone help me to figure out what went wrong here?
>
>> X-Spam-Status: No, score=-2.9 required=5.0 tests=ALL_TRUSTED,BAYES_00
>>   autolearn=ham version=3.3.2, No
>
> AFAIK, header matching is case-insensitive. That's why 'YES' matches 'BAYES' and triggers the action.
So any spammer might simply add a Header "X-Spam-Status: No"
and the Mail gets into the INBOX ?

Thats why my exim / spamasssassin combination adds the
header "X-Spam-Status:" with all the various checks and
if and only if the score is above e.g. 5 points it additionally adds
the header "X-Spam-Flag: YES" .
Ham mail is not affected with this "X-Spam-Flag".

My global sieve filter only checks for the existance of
the header line - not the value. I think this can't be
circumvented by the spammers.

Regards, Olaf

--
Karlsruher Institut für Technologie (KIT)
ATIS - Abt. Technische Infrastruktur, Fakultät für Informatik

Dipl.-Geophys. Olaf Hopp
- Leitung IT-Dienste -

Am Fasanengarten 5, Gebäude 50.34, Raum 009
76131 Karlsruhe
Telefon: +49 721 608-43973
Fax: +49 721 608-46699
E-Mail: [hidden email]
atis.informatik.kit.edu

www.kit.edu

KIT – Die Forschungsuniversität in der Helmholtz-Gemeinschaft

Das KIT ist seit 2010 als familiengerechte Hochschule zertifiziert.



smime.p7s (7K) Download Attachment
Gao
Reply | Threaded
Open this post in threaded view
|

Re: sieve filter move wrong email to Junk folder

Gao
In reply to this post by Steffen Kaiser-2
Thanks for all of your help.

Now I modified my sieve script. Three things changes here:
1.   if header :contains "X-Spam-Status" "YES, " {
2.  if header :contains "subject" ["{SPAM?}"] {  ##add the curly brackets
3.  change the order. So send my Mailscanner labeled spam mail directlly
to the junk folder.

The first one try to avoid the BAYES_ trigger the rule. The 2nd one is
for MailScanner labeled spam mail. So the final script:
   require "fileinto";
   if header :contains "subject" ["{SPAM?}"] {
     fileinto "Junk";
     stop;
   }
   if exists "X-Spam-Status" {
           if header :contains "X-Spam-Status" "YES, " {
           fileinto "Junk";
           stop;
           } else {
       }
   }

I'll see how this works.

Gao



On 2017-12-15 12:38 AM, Steffen Kaiser wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On Fri, 15 Dec 2017, Bill Shirley wrote:
>
>> This is what I use.  Notice the comma:
>> require "fileinto";
>> if header :contains "X-Spam-Status" "Yes," {
>>   fileinto "SystemFolders.SuspectedSpam";
>>   stop;
>> }
>
> I would even add the space:
>
> if header :contains "X-Spam-Status" "Yes, " {
>
> because the list of tests won't contain a space.
>
> - -- Steffen Kaiser
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1
>
> iQEVAwUBWjOKB8QnQQNheMxiAQIdeAgAyL+FDM/DE5J1sRkJ6P8MuIAT3Zx8zfPO
> Mljn/kswG551jyso2FfGqAw6et5uHrab3Wk22NxQVK6yR4ySZstr3RF9ICeuJVvs
> pNFzyvBf0BivihWZLMWiVum0/B0LfpW6T7B93Yvbl/JXei2C6+uy8Mk2zFo/5jWP
> lpKdIxWs/SMmsjFE2QccfP7Id1aUw+tYM+9P/fzc0/kGkNRs5UCodeo/e30opdvv
> tJ8QpwPV/873uhk9p5m2NB/0bi4i9Rg5VMC2ui5trVlyOR2q2WpYVZ1gV2tvVpEA
> B3QY8vrzDf9xb1zDoVi8hMDCqynZZGQ++nSfIux/7DBDJvvYx5sYKg==
> =sUdv
> -----END PGP SIGNATURE-----