Predicates
A rule is one JSON object with one key. Regexes use JavaScript syntax and are case-insensitive. String comparisons are case-insensitive.
| Predicate | Matches when |
|---|---|
{"any": [p, …]} | Any child matches. |
{"all": [p, …]} | Every child matches (and there is at least one). |
{"not": p} | The child does not match. |
{"address": "orders@"} | Local part of the receiving address equals orders. A full address matches exactly. |
{"sender": "a@b.example"} | From address equals. |
{"sender_domain": "b.example"} | From domain equals. ".b.example" also matches subdomains. |
{"subject_contains": "x"} or ["x", "y"] | Subject contains any of the strings. |
{"subject_matches": "regex"} | Subject matches. |
{"header": {"name": "X-Priority", "contains": "1"}} | A header with that name contains the string; matches for a regex; neither for mere presence. |
{"text_contains": [...]} | Sanitized body text contains any. |
{"text_matches": "regex"} | Body matches. |
{"has_attachment": true} | At least one attachment (allowed or not). |
{"attachment_name_matches": "\\.pdf$"} | Any attachment filename matches. |
{"attachment_mime": ["application/pdf"]} | Any attachment has one of the types. |
{"attachment_text_contains": [...]} | Any allowed attachment's text contains any of the strings. |
{"auth": {"spf": "pass", "dkim": "pass", "dmarc": "pass"}} | Each given result equals. Values: pass, fail, none, softfail, neutral, temperror, permerror, unknown. |
Results report the path of the deciding predicate, such as rule.any[1].all[0].sender_domain.
This page as Markdown.