[Rspamd-Users] email:domain vs email:domain:tld

[Kai Schaetzl]

You are viewing this from the wrong side. You don't look at what a domain 
"is". you look at what you want to catch/match. TLD in rspamd actually 
means "second-level domain", not TLD as we are used to know it.

If you want to catch the full right part of an email address, than you use 
"email:domain". If you want to catch only the TLD part of an email address 
you use "email:tld". It doesn't explicitely say you can't combine that in 
documentation. But I think it's not gonna work at all, it makes no sense. 
The part after : just tells what part of the email address you want to 
match. With domain you already match against the tld as it is included in 
the hostname.

"email:domain" catches:
whatever at mail.example.com
whatever at example.com

"email:tld" catches only:
whatever at example.com

I use TLD only for clients, like:

type = "received";
filter = "tld:real_hostname";

this would match the domain part of the hostname and not the full 
hostname.



Kai