Re: Reject mails with two different mail addresses in From Header

On 14/3/2022 10:42 π.μ., Matus UHLAR - fantomas wrote:

> looks perfectly valid.  Note that L_OLEMACRO_ZIP_PW and 
> L_FROM_2_EMAILS each score 1 point by default.
> If this is not what you want, start name with __
>
> ... I use L_ as prefix for local rules, __ prefixes test rules (no 
> score by default) and T_ prefixes test rules (score 0.01 by default).
>
> rules with score 0 are not evaluated unless they are prefixed with __
>
>> Also, what should I do to catch (and score) ALL mails with 2 
>> different mail addresses in the From header (regardless whether there 
>> is an encrypted zip attachment or not)?
>
> the __PDS_FROM_2_EMAILS should catch excatly this, but since the rule 
> name starts with __, it has no points by default.
>
Thank you Matus,

I appreciate your help.

I am studying your notes; I also found supplementary documentation to 
help me gain some better insight 
(https://cwiki.apache.org/confluence/display/SPAMASSASSIN/writingrules).

In case I need more of your valuable clarifications, I will have to 
disturb you a bit again.

One of those is: Why use parentheses in some cases, like: 
(__PDS_FROM_2_EMAILS) ? Do parentheses have particular significance by 
modifying operation/evaluation?

Thanks again,
Nick