require ["comparator-i;ascii-numeric","date","fileinto","index","relational"]; # rule:[index-header1] if header :index 1 :last :contains "X-DSPAM-Result" "Spam" { fileinto "Spam"; stop; } # rule:[index-header2] if header :index 2 :contains ["From","To"] "test@domain.tld" { discard; stop; } # rule:[index-address] if address :index 1 :is "From" "nagios@domain.tld" { fileinto "domain.tld"; stop; } # rule:[index-date] if date :index 1 :last :zone "-0500" :value "gt" :comparator "i;ascii-numeric" "received" "iso8601" "2007-02-26T09:00:00-05:00" { stop; }