Predicates

A rule is one JSON object with one key. Regexes use JavaScript syntax and are case-insensitive. String comparisons are case-insensitive.

PredicateMatches when
{"any": [p, …]}Any child matches.
{"all": [p, …]}Every child matches (and there is at least one).
{"not": p}The child does not match.
{"address": "orders@"}Local part of the receiving address equals orders. A full address matches exactly.
{"sender": "a@b.example"}From address equals.
{"sender_domain": "b.example"}From domain equals. ".b.example" also matches subdomains.
{"subject_contains": "x"} or ["x", "y"]Subject contains any of the strings.
{"subject_matches": "regex"}Subject matches.
{"header": {"name": "X-Priority", "contains": "1"}}A header with that name contains the string; matches for a regex; neither for mere presence.
{"text_contains": [...]}Sanitized body text contains any.
{"text_matches": "regex"}Body matches.
{"has_attachment": true}At least one attachment (allowed or not).
{"attachment_name_matches": "\\.pdf$"}Any attachment filename matches.
{"attachment_mime": ["application/pdf"]}Any attachment has one of the types.
{"attachment_text_contains": [...]}Any allowed attachment's text contains any of the strings.
{"auth": {"spf": "pass", "dkim": "pass", "dmarc": "pass"}}Each given result equals. Values: pass, fail, none, softfail, neutral, temperror, permerror, unknown.

Results report the path of the deciding predicate, such as rule.any[1].all[0].sender_domain.

This page as Markdown.