Search results

Make a new Match field what object with the field being Received and value containing TLS. Then create an action object with the field being subject and value being: NO_TLS: __SUBJECT__ . That should do the trick but there could be multiple received headers with the TLS but not specifically...

A quick look through the log file shows most are hitting Spam>10 and you have SpamScore as the second rule. You'll need to move your rules up or move the Spamscore down below them.