Astaro User Bulletin Board
Go Back   Astaro User Bulletin Board > Astaro Gateway Products > Mail Security: SMTP, POP3, Antispam and Antivirus

Welcome to the Astaro User Bulletin Board.
If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below.

Reply
 
LinkBack Thread Tools Display Modes
  #1 (permalink)  
Old 02-05-2010, 08:38 PM
Senior Member
 
Join Date: Feb 2006
Posts: 445
Default Expression Filter regex help

Several months ago we changed our company name and along with this, changed our public domain name. Since then, I've relied upon the end users to notify those who send us emails about the change along with some mass notifications. This has worked to get us mostly switched over at this point, but we still get a few emails addressed to the old domain each day.

Within the next couple of months, I'll be turning off the old domain name completely and need to put a bit more administrative effort into getting the remaining folks who send us emails "fixed".

What I'd like to do is use a regex entry in the expression filter to catch anything addressed to "olddomain.com" and hold it in the quarentine until reviewed. I tried using just "olddomain.com" as a string value, but that had the unintended effect of also catching addresses in the body of emails in long term "reply to" threads that have already changed to "newdomain.com".

Any chance somebody can help me come up with a regex that will only check the To: and CC: lines in the current header for *@olddomain.com.

Thanks.
Reply With Quote
  #2 (permalink)  
Old 02-05-2010, 09:22 PM
Moderator
 
Join Date: Jul 2001
Location: southern California
Posts: 5,156
Default

this might work:

^[To|CC]:.*\@olddomain.com$

Barry
__________________
http://DealBert.net
Home & business end-user since v1.x
  • ASL 6.3x, HP DL145 Dual Opteron, 1GB RAM, 6 gigE NICs, 50-IP Platinum License
  • ASL 7.3x, Dell PE1550 Dual PIII 1GHz, 1GB RAM, 2 NICs, 50-IP Platinum License
  • ASL 7.5x, 17-watt fanless mini-ITX system: MSI IM-945GSE-A Atom n270, 2GB RAM, Morex T3310 case. 2 Intel GigE, 3 VLANs. 80G 5200rpm 2.5" HD
    Netgear GS108T gigE VLAN switch & Linksys WRT54G WAP
    Total network infrastructure: 27 watts. 100-IP Home User. FiOS 10mb/2mb
Reply With Quote
  #3 (permalink)  
Old 02-05-2010, 09:45 PM
Senior Member
 
Join Date: Feb 2006
Posts: 445
Default

Cool, I'll give it a shot.

For case insensitivity, I would make it:

(?i)^[To|CC]:.*\@olddomain.com$

right?

Thanks,
Reply With Quote
  #4 (permalink)  
Old 02-05-2010, 10:24 PM
Senior Member
 
Join Date: Feb 2006
Posts: 445
Default

Blah, no dice.

This expression is letting the olddomain.com addresses through.
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On



All times are GMT. The time now is 03:15 AM.

 

Powered by vBulletin® Version 3.8.4
Copyright ©2000 - 2010, Jelsoft Enterprises Ltd.


These pages are specifically maintained for the discussion of firewall issues within the Open Source community, and might already reflect new alpha/beta releases under development. Please refer to our product specifications for the functionality of the actual release. Discussions of new/enhanced functionality does not constitute a commitment of Astaro, to integrate this functionality into future releases. issues within the Open Source community, and might already reflect new alpha/beta releases under development. Please refer to our product specifications for the functionality of the actual release. Discussions of new/enhanced functionality does not constitute a commitment of Astaro, to integrate this functionality into future releases.