Rspamd supports operators between patterns. Here's an example from my regexp.conf: WA_LISTERV_EMAIL_STORM { re = 'To=/@listserv\..*\.wa\.gov/i{header} && (!From=/\.wa\.gov/i{header} || From=/dmarc-request at listserv\..*\.wa\.gov/i{header})', score = 20, description = 'Replies to Washington State mailing lists', } Andy