This article applies to:
- Trustwave MailMarshal (SEG)
- Trustwave ECM/MailMarshal Exchange
- MailMarshal SPE
- Header Match or Header Rewrite function
Question:
- How do I match text at the beginning of a line?
- Regular expression like ^(text) does not work in Header Match
- The expression works in the rule tester but does not always work in production
Reply:
SMTP email headers consist of a name, colon, and value.
All text after the colon is considered to be part of the value.
Some systems insert a space after the colon while others do not.
For example the email subject header could be either of the following:
- Subject:text
- Subject: text
MailMarshal header matching uses the entire string after the colon, including a space if any.
If you want to match the text at the start of the line ignoring spaces, you can use a search similar to the following:
^(\s*text)
This search matches at the beginning of the line (the ^ operator) and includes any whitespace (matched by \s* ) before the text. It matches either of the subject lines above.
