Take the 2-minute tour ×

We are getting a lot of spam in the form femlmcte@tnbt.com.

I can see cPanel Spam assassin allows a regex match to be used to filter mail.

I want to write a regex expression that identifies mail in the form




i.e ONLY four letters after the @, but before the .com, .co.uk, .co.za etc

share|improve this question
And, what have you tried yourself so far? =) –  J. Steen Sep 14 '12 at 10:09
What about all the non-spam that comes from anylengthofstrring@abcd.com? I wouldn't mark as spam everything that comes from four letter domains. –  ZZ-bb Sep 14 '12 at 10:13
You don't have to; you can create a rule with a limited score, such as one, and hope that the problematic messages will have enough other spam markers to bring the score up above the threshold. This is fundamental to how SpamAssassin works. –  tripleee Sep 14 '12 at 10:50
add comment

closed as not a real question by xdazz, George Stocker Sep 16 '12 at 0:58


2 Answers

up vote 0 down vote accepted

Try the following:



[^@]+@                # One or more characters except @ followed by @
[a-zA-Z]{4}           # Matches 4 characters in the range A-Z and a-z
\.(com|co\.uk|co\.za) # Matches .com, .co.uk, and .co.za

If you want to match any tld, replace (com|co\.uk|co\.za) with .* (I'm assuming that since you are receiving these e-mails, you already know they are valid, so no need to validate the TLD).

Also note that with your current criteria, you'd consider as spam something from admin@food.com, which may or may not be what you want.

share|improve this answer
Consider the possibility of more than three top domains... =) –  J. Steen Sep 14 '12 at 10:10
@J.Steen: Yes, but I think OP doesn't want to match those. I suppose he only considers these three domains as spam. –  João Silva Sep 14 '12 at 10:11
OP did say "etc", so I think he means more than just those top domains. In any case, just consider it. –  J. Steen Sep 14 '12 at 10:12
@J.Steen: You're right, I didn't see the etc. I've edited my answer to reflect that. –  João Silva Sep 14 '12 at 10:15
@JoãoSilva - Thank you for taking the time to explain the syntax. J.Steen - I started with ^\w+@[a-zA-Z_]+?\.[a-zA-Z]{2,3}$ as a standard to identify an e-mail format - and was getting my head aroumd that before trying here :) –  Arthur Mild Sep 14 '12 at 10:33
add comment

So you want to match an at-sign followed by 4 non-dot characters, followed by a dot? This specification translates easily into a regexp:

share|improve this answer
Thank you. The plan is to see if we can filter these mails, then check the filter to catch any 'real' mails that happen to match. –  Arthur Mild Sep 14 '12 at 10:30
add comment
