The new ORF 4.1 Alpha release offers keyword filtering in the raw MIME email header with the usual simple text search / regular expression modes. This opens up a few possibilities that were previously unavailable in ORF, such as filtering based on the MIME sender, a specific email header field or the charset.

We strongly recommend using regular expressions for creating header keyword filters, as simple text filters may have unexpected consequences. For instance, you may want to blacklist emails with the koi8-r Cyrillic charset, but using just “koi8-r” may blacklist emails that has subject “How to blacklist koi8-r emails”.

A few regular expression examples for filtering for specific email fields:

• MIME sender email address
  .*^From:.*\bsendertofilter@example.org\b.*\s$
• Email subject with koi8-r charset
  .*^Subject:.*=\?koi8-r\?.*\s$
• Presence of “X-Spam-Status: YES header”
  .*^X-Spam-Status: YES\s$