re2 regex expression that starts with From: and ends with domain.com

Question

I'm trying to come up with a regex expression I can use for filtering incoming email to my Google Apps domain. I'm using Content Compliance to check if it's signed using DKIM and then see if the "From:" part of the header contains our domain name. If it's unsigned and DOES contain our domain name I'm sending it to quarantine.

The expression I have in place is probably over-complex and still missing things. Today it missed:

From: "Employee Name" <employeename@mydomain.com>

What I need is an re2 (the version Google uses) regex expression that will match:

From: any-combination-of-letters-and-special-characters@mydomain.com

I've been using the following but, it's missing some:

((From:)\s{0,1}([\w.+\-]{0,40})\s{0,1}(\W|^)[\w.+\-]{0,25}@(mydomain)\.com(\W))

Any help would be greatly appreciated!

Try [`From:\s{0,10}"[\w.+\s\-]{0,25}"\s{0,1}\W[\w.+\-]{0,25}@mydomain\.com\W`](https://regex101.com/r/sG7kE1/1). — Wiktor Stribiżew, Aug 13 '15 at 21:50
Unfortunately they don't always follow the same format. Sometimes it will be like the one above but, other times it will be just `employeename@mydomain.com` I really need something that matches when the string starts with `From:` and ends with `mydomain.com` no matter what comes in between. — Shc Final Judgement, Aug 13 '15 at 23:53
The problem might be with the length. If this is the case where you cannot use `*` or `+` quantifers, `From:.*?@mydomain\.com` will not work. — Wiktor Stribiżew, Aug 14 '15 at 06:19

Md. Mohsin · Answer 1 · 2015-08-14T18:24:10.333

0

Try this,

'(From)(:)(\\s+)(".*?")(\\s+)(\\<)((?:[a-z][a-z]+))(@)((?:[a-z][a-z\\.\\d\\-]+)\\.(?:[a-z][a-z\\-]+))(?![\\w\\.])(\\>)'

Here From: will be fixed.

"Employee Name" #can replace any string within quotes
<employeename@mydomain.com> #can replace any email within <> tag

For @mydomain.com

You may use this,

'(From)(:)(\\s+)(".*?")(\\s+)(\\<)[\\w\\.-]+(@)(mydomain\\.com)(\\>)'

Let me know if it helps

edited Aug 14 '15 at 18:24

answered Aug 14 '15 at 04:25

Md. Mohsin

1,822
3
19
34

@Shc Final Judgement Also let me know if you need minor tweaks, I will update my answer according to your requirements, Thanks – Md. Mohsin Aug 14 '15 at 04:27
Thank you Md. Mohsin. I need it to just match our domain. I'm using this to block people spoofing our domain when sending to us. Can the end part just be `mydomain\.com`? – Shc Final Judgement Aug 14 '15 at 11:21
Something that combines `^(From:)` and `@(mydomain)\.com$` – Shc Final Judgement Aug 14 '15 at 12:35
Does this look like it would work? `^(From:).*@(mydomain)\.com(\W)$` – Shc Final Judgement Aug 14 '15 at 12:46
@Shc Final Judgement Updated the answer. Let me know if that helps – Md. Mohsin Aug 14 '15 at 18:24
Thanks again Md Mohsin! I'm not sure but, I think the version of regex being used by Google is a little different. Your code seems to have more slashes than what I have to use. In the end this `^(From:).*@(mevion)\.com(\W)` seems to be catching everything but, I still appreciate your contribution! – Shc Final Judgement Aug 14 '15 at 22:09

score 0 · Accepted Answer · answered Aug 17 '15 at 17:18

0

For us, this is working. Thank you to everyone that helped!

^(From:).*@(mevion)\.com(\W)

answered Aug 17 '15 at 17:18

Shc Final Judgement

87
1
11

re2 regex expression that starts with From: and ends with domain.com

2 Answers2