5.4.4.1   Rule Columns, Locations, and Match Styles

This section explains the options available for each rule in SpamSieve’s blocklist and allowlist windows.

Rule Columns

The meanings of the columns are as follows:

⚑

Whether the rule has been marked as flagged. You may want to flag rule that you’re observing or tweaking or that you’ve put on probation so that you can easily find it again later.

Location

The part of the message that will be matched against the rule.

Match Style

How the rule text will be matched against the text from the message.

Text to Match

The text that will be matched against the message.

Enabled

If this is checked, the rule is enabled. Disabled rules do not block any messages, but they are useful because they prevent SpamSieve from re-learning a rule that you don’t want. (See Rules and Training.) If an auto-trained rule is incorrect, you should generally not disable or delete it; instead, train the message that caused SpamSieve to create the rule.

Locked

If this is checked, SpamSieve will keep the rule enabled even if you train it with a message that contradicts the rule. Normally, when you train a message as spam, SpamSieve will disable any matching allowlist rules; and when you train a message as good, SpamSieve will disable any matching blocklist rules. This prevents such “incorrect” rules from causing filtering mistakes for future messages. Locking which prevents rules from being automatically disabled in this manner. This is useful when you are really sure that a rule does what you intend, for example if you want messages matching a certain rule to always be classified as good, even if some spam messages also match that rule.

Created

The date that the rule was added to the blocklist or allowlist.

Modified

The date that the rule was last edited or updated.

Matched

The date that the rule was last used to classify a message.

Correct

The number of times the rule was used to correctly classify a message.

Incorrect

The number of times the rule was used to classify a message but then you trained the message to tell SpamSieve that it was mistaken.

Rule Locations

When SpamSieve checks whether a message matches a rule, it compares the part of the message named by the Rule Location column with the contents of the rule’s Text to Match column. The following are the message parts that may be used in the Location column:

From (address)

The e-mail address of the message’s sender.

From (name)

The name of the message’s sender.

To (any address)

The e-mail addresses of the primary recipients of the message. SpamSieve checks each recipient separately to see whether it matches the rule.

CC (any address)

The e-mail addresses of the carbon copy recipients of the message. SpamSieve checks each recipient separately to see whether it matches the rule.

Reply-To (address)

The address that you would be sending to if you replied to the message. This is often the same as the From address, but it could also be a mailing list or an alternate address for the sender. If the message does not specify a Reply-To, then the rule will not match.

SendTo

The message’s SendTo header.

Any Recipient

The To and CC addresses.

Any Address

The From, To, CC, Reply-To, and SendTo addresses.

List-ID

For mailing list messages, this hidden header indicates which mailing list the message was sent to.

List-Unsubscribe

For mailing list messages, this hidden header indicates how to unsubscribe from the mailing list. Some mailing list messages that do not have a List-ID header do have a List-Unsubscribe header.

Mailing-List

For mailing list messages, this hidden header indicates which mailing list the message was sent to. Some mailing list messages that do not have a List-ID header do have a Mailing-List header.

Received (any)

The Received headers contain information about the servers that relayed the message on its journey from the sender to the recipient.

Return-Path

This header contains information about where the message originated.

Subject

The subject of the message.

Body (any text part)

The contents of the message. Some messages contain more than one text part (for instance, plain text and HTML representations of the same message). The rule matches the message if any of the text parts matches the rule’s text.

Any Character Set

The character set often indicates the language of the message. Many spam messages are sent using Asian or Cyrillic character sets, and SpamSieve is pre-configured to block these. The IANA maintains a list of character sets.

Any Attachment Name

Many spam messages contain attachments whose names end with .pif or .scr. SpamSieve ships with some blocklist rules pre-configured to catch messages containing spammy attachments.

Rule Match Styles

There are several different ways in which SpamSieve can compare the text in the message’s header to the rule’s text. In all cases, capitalization does not matter; lowercase letters are considered the same as their uppercase counterparts.

Is Equal to

The message matches the rule if its text is exactly the same as the rule’s text. This is the fastest style of matching. If you leave the text blank, the rule will match messages that have blank values for that header—for example when there is an empty Subject header. Sometimes, messages (especially spam ones) omit headers. To match an omitted header, enter <SpamSieve-Unknown-Subject>, <SpamSieve-Unknown-From>, <SpamSieve-Unknown-FromName>, or <SpamSieve-Unknown-To> depending on the header selected.

Contains

The message matches the rule if the message text contains the rule text.

Starts with

The message matches the rule if the message text begins with the rule text.

Ends with

The message matches the rule if the message text ends with the rule text. This is useful for matching domain names. For example, to match messages sent from Apple, you could create an Ends with rule with text @apple.com.

Matches Regex

This is like Contains, except that the rule text is treated as a ICU regular expression. Regular expressions are a powerful way of specifying patterns of text, for instance: e-mail addresses that contain numbers before the @ sign or subjects that are longer than 30 characters.

If the regular expression entered in the Text to Match column is invalid, SpamSieve will color it in red, and it will not match any messages.

Rule Comments

There’s a space to enter comments for each rule, e.g. to help you remember why you created a rule or how a regex was intended to work. You can search for rules by comment.