I have been searcing this site and google for a simple answer to a rather simple problem. I have an employee who wants his procmail filter to only allow emails from the domain wiu.edu and the rest to be deleted as they come in. I wrote a .procmailrc file as fillows.

The problem is that alot of email is filtered but there are some that still end up in the inbox. Is there a better way to achive this or is what I have all wrong. I am rather new to filtering with procmail so I based what I have off what I have seen elsewhere. Any help would be great. So I need to send all email form wiu.edu to the inbox and everything else from anyone outside the university needs to be deleted. Thanks.

Can you show at least one depersonalized header (e.g., some spam includes receiver name in header - remove it)? Maybe you need to tell procmail that no @ is allowed until eol.

What exactly are you wanting?

You have some filter. Something wrong goes through. I want an example of what has gone through (but shouldn't have), surely headers-only, with every occurence of your employee's username/real name replaced by thename.

Note that it's very hard to filter spam which forges From: to be a valid email address (yes, I mean existing) from target's domain.

After looking at a bunch of headers they do throw in a wiu.edu before the @ symbol for the username. If I change "* ^From.*wiu.edu" to "* ^From.*@wiu.edu" would that help any?

I guess that will make flow smaller. Also think about ^From:.*@wiu.edu[^@]*$

what does [^@]*$ tell the filter to do?

after edu there are no '@' until end-of-line ($).

Well I tried what you suggested and now it filters out all email from wiu.edu also.

Eh.. How does the false positive's header look like (surely not asking to show me real username, replace by root..)

Do you want the header information from an email that wasn't suposed to be filtered?

Yes. And anything that is recognized wrong..