# Predicates

A rule is one JSON object with one key. Regexes use JavaScript syntax and are case-insensitive. String comparisons are case-insensitive.

| Predicate | Matches when |
|---|---|
| `{"any": [p, …]}` | Any child matches. |
| `{"all": [p, …]}` | Every child matches (and there is at least one). |
| `{"not": p}` | The child does not match. |
| `{"address": "orders@"}` | Local part of the receiving address equals `orders`. A full address matches exactly. |
| `{"sender": "a@b.example"}` | From address equals. |
| `{"sender_domain": "b.example"}` | From domain equals. `".b.example"` also matches subdomains. |
| `{"subject_contains": "x"}` or `["x", "y"]` | Subject contains any of the strings. |
| `{"subject_matches": "regex"}` | Subject matches. |
| `{"header": {"name": "X-Priority", "contains": "1"}}` | A header with that name contains the string; `matches` for a regex; neither for mere presence. |
| `{"text_contains": [...]}` | Sanitized body text contains any. |
| `{"text_matches": "regex"}` | Body matches. |
| `{"has_attachment": true}` | At least one attachment (allowed or not). |
| `{"attachment_name_matches": "\\.pdf$"}` | Any attachment filename matches. |
| `{"attachment_mime": ["application/pdf"]}` | Any attachment has one of the types. |
| `{"attachment_text_contains": [...]}` | Any allowed attachment's text contains any of the strings. |
| `{"auth": {"spf": "pass", "dkim": "pass", "dmarc": "pass"}}` | Each given result equals. Values: `pass`, `fail`, `none`, `softfail`, `neutral`, `temperror`, `permerror`, `unknown`. |

Results report the path of the deciding predicate, such as `rule.any[1].all[0].sender_domain`.