This article applies to:

• Trustwave MailMarshal (SEG)
• Trustwave ECM/MailMarshal Exchange
• MailMarshal SPE
• Header Match or Header Rewrite function

Question:

• How do I match text at the beginning of a line?
• Regular expression like ^(text) does not work in Header Match
• The expression works in the rule tester but does not always work in production

Reply:

SMTP email headers consist of a name, colon, and value.

All text after the colon is considered to be part of the value.

Some systems insert a space after the colon while others do not.

For example the email subject header could be either of the following:

• Subject:text
• Subject: text

MailMarshal header matching uses the entire string after the colon, including a space if any.
If you want to match the text at the start of the line ignoring spaces, you can use a search similar to the following:

^(\s*text)

This search matches at the beginning of the line (the ^ operator) and includes any whitespace (matched by \s* ) before the text. It matches either of the subject lines above.