the rule 'match fiels' does not work correctly

[flynn]

Hi guys!
Not long ago, I set up a rule for checking the body of the letter.This is necessary so that attackers cannot substitute one of our domains in the body of the letter.



rule test:
MAIL FROM:<test@blabla.com>
250 2.1.0 Ok
RCPT TO:<garry@example.com>
250 2.1.5 Ok
data
354 End data with <CR><LF>.<CR><LF>
From:message <test@example.com>
Subject:test
sdsa
.
554 5.7.1 Rejected for policy reasons (10101B631F246F15AF9)



Test passes successfully!


After testing, the "check from" rule was moved to production.
After a while, it became clear that the rule was mistakenly blocking emails.
I've been breaking my head trying to match regular expressions, but it didn't work.
Example:
(^)*@example\.(com|com\>)($)
.*@example.com$
@example\.com\>($)
etc.....

I ask for help.

 

[Stoiko Ivanov]

The regex seems quite odd
`(^)*@example\.(com|com\>)($)`
the grouping of ^ and $ (begin/end of line) makes no sense - you could even try to skip the anchoring at all

else please share some examples (mail source as well as logs - as text) where the blocking happened where it should not happen...