Re: Is Spamassassin anchored or not ?

[Loren Wilton <lw...@earthlink.net>]

> Strange as it may seem the spam that I'm trying to catch always comes in
as
> To: Joe Blow <re...@example.com>

Late on chiming in on this, but I would write a rule for that specific
address (only) as

header JOEBLOW    ToCc =~ /^\s*Joe\sBlow\s{0,5}<real\@example\.com>/i

If (from what I recall of your original rule) "joe blow" is really a
nmemonic for any two-word name, and it always contains alphas, and they
always have initial caps, I would write:

header JOEBLOW ToCc =~
/^\s*[A-Z]\w+\s{1,5}[A-Z]\w+\s{0,5}<\w+\@\w+\.(?i:com|net|biz|info)>/    #
no /i

Or something close along those lines.

        Loren