[Rspamd-Users] Rule not triggering on test email

[Sophie Loewenthal]

Hi guys,


I wrote this rule to kill off some uncatchable spam:

# cat /etc/rspamd/local.d/settings.conf 
SJL_AIRMAIL_DIE {
re = "From=/\@mail\.appcenter\.ms/iH" ;
group = "header";
description = "Poison pill"
score = 10; # 10 set for testing. Will be 20 later.
}

The test email contains this string:
From: App Center Team <no-reply at mail.appcenter.ms>

Tested with this but the mail was scored with 1.58 / 15.00

 # cat 1573523082.M912671P31937.mx10\,S\=19091\,W\=19642\:2\,Sbs |rspamc symbols
Results for file: stdin (1.180 seconds)
[Metric: default]
Action: no action
Spam: false
Score: 1.58 / 15.00
Symbol: ARC_NA (0.00)
Symbol: DKIM_TRACE (0.00)[mail.appcenter.ms:+]
Symbol: DMARC_POLICY_ALLOW (-0.50)[mail.appcenter.ms, reject]
Symbol: FROM_HAS_DN (0.00)
Symbol: FROM_NEQ_ENVFROM (0.00)[no-reply at mail.appcenter.ms, 6d3e4e4a.EAAAAHyUnjUCAAAAAAAAAARsquQAAAA6pnMAAAAAAAvpOQBdyg6J at bnc3.mail.appcenter.ms]
Symbol: HAS_LIST_UNSUB (-0.01)
Symbol: MANY_INVISIBLE_PARTS (1.00)[10]
Symbol: MIME_HTML_ONLY (0.20)
Symbol: MIME_TRACE (0.00)[0:~]
Symbol: MX_GOOD (-0.01)[cached: bnc3.mailjet.com]
Symbol: PREVIOUSLY_DELIVERED (0.00)[sophie at klunky.co.uk]
Symbol: RCPT_COUNT_ONE (0.00)[1]
Symbol: RCVD_COUNT_TWO (0.00)[2]
Symbol: RCVD_NO_TLS_LAST (0.10)
Symbol: R_DKIM_ALLOW (-0.20)[mail.appcenter.ms:s=mailjet]
Symbol: TO_DN_ALL (0.00)
Symbol: ZERO_FONT (1.00)[20]
Message-ID: 6d3e4e4a.EAAAAHyUnjUCAAAAAAAAAARsquQAAAA6pnMAAAAAAAvpOQBdyg6J at mailjet.com
Urls: ["www.reddit.com","join.slack.com","fonts.googleapis.com","www.hockeyapp.net","airmailapp.com","install.appcenter.ms"]


What did I miss and am I testing this the right way?

Thanks, So.