our CIO is complaining about spam emails making it to his inbox with no from address displaying in outlook.   When I get to the headers of the email I see it's real from address is:

Are the spamfilter searches single line?  I've never had any luck with ^ working as a start of line when doing spamfilter regex.

I don't have a specific example at the moment.

I've never been able to figure out how to engage multiline to be able to use ^ in an expression.  I don't think the example you give above would work.  Using the regex test window in spamfilter even something as simple as this would not work:

^from or this (^from)

I use Rad Software Regular Expression Designer for testing my regex.  I leave the singleline option enabled in that software as I find that matches what spamfilter's regex does - meaning the ^ would only match at the very start of the string - not each line.

Is there any recent user guide available?  I installed my spamfilter way back and just apply the updates so I don't have any recent manual.  I would like to go over the regex section again and see what modifiers are available.... maybe I am missing something to make multiline work so I could use ^

OK, after a bit of documentation reading I could change your expression to this:

((?im)^from:.*\w.+:)

and it works in the tester window.  I have added it to my own keyword list and will see if it catches anything, even though we don't have a known spam problem that the OP stated.

A couple of other things to keep in my with spamfilter regex, it can't be the first keyword.  You must use a non reg keyword first, so something like:

http,((?i)^from:.*\w.+:)

Also you can't use any , in any expression.  The manual makes mention of things like this being allowed

555{3,6}

But that actually will not work because the , conflicts with the comma delimited list of keywords.

I was under the impression that if you wanted to use regex, you had to use a non regex keyword first (don't know if that is true or not).

Anyway, I tried this for a few hours:

((?im)^from:.*\w.+:)

It stopped an amazing 20,000+ messages before I stopped it.  It was triggering on stuff like this:

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=facebookmail.com;
    s=s1024-2013-q3; t=1419179688;
    bh=zvKprC165Uj54NJsXq+FCPDpdJ5NmqBef3SlJ4isOW4=;
    h=Date:To:From:Subject:MIME-Version:Content-Type;
    b=fhb+3MdEvYOHHvdHJk42yTnMdRpcZz00VlVnYma3pYwTUEXhNCl9M7REYmT0inn93
     wyUgbw3iYd9b+hFg09Jotcc6GdRpwdpseTL4oxcZHEWFCirpVGRXnTK7BML8Js9SWZ
     uUcZ45nDyTUXDtTa7pGvR5xjwzKDTpeWzybgn+J4=
Received: from facebook.com (UdjrGX6wsOXSz0WD+9OTzGASp4gIIja7+HPf9pIIu7ymp0nNXCB4zGVb2G3cEBG+ 10.103.99.81)

The question is, why?  If the ^ means the start of a line, why is it triggering on that?

I'm not having any luck using the start of line character ^

I did get a stand alone regex to function though, I thought in order to use regex you had to use a regular keyword before you could use a regex.  However, today I got this to trigger a few items:

(http://[a-z]+.[a-z0-9]+.rocks)

What I can't get to work correctly is the ^, like these do not seem to trigger anything.

(^from:.*<.*\.click>)
((?im)^from:.*<.*\.click>)

Yes, I want to stop .click.  I think my expression options are saying multiline, not case sensitive.  I want to stop mail that is from a .click email address in the from header line.  Stuff like this:

Message-ID: <472a92d26bb9f7517d517a4c882c2291@sistema.optdatacrm.click>
From: "Claro Empresas" <emm@optdatacrm.click>
Reply-To: emm@optdatacrm.click
MIME-Version: 1.0

Using this expression (?im)^from:.*<.*\.click> I think it should stop the example above, but no joy.

I don't know what I'm doing wrong, but it would be very cool if I could figure it out.

Yes, I have header scanning enabled.

It is possible that there really has not been a hit yet, the keyword scanning is quite far down on the list.  Maybe I will add a few more using the ^ technique as I have never used it before successfully and see if something triggers it.

Actually, I just checked my quarantine - and there are two messages there from you!  Triggered by a .click rule, this one:

Found Keywords: [((?im)^from:.*<.*\.click>)]

No, or it would not have been in my quarantine  

However, I do think we have some option enabled where if we 'accept' the message but the destination is quarantine then we do not send back a rejection notice...  I think, that was some option in the .ini file but I have no idea what it was.

When we report the message as rejected, the number of calls/email messages we get for support just go through the roof. 

Ok, I think I've got my problem sorted out.  I ran these two:

((?im)^from:.*<.*\.rocks>)
((?im)^from:.*<.*\.click>)

I have been surprised how little they have picked up (your two tests and a couple others).  The 'others' it picked up were not what I wanted.  It triggered on an email with a from: in the headers and an email ending with .rocks much further down (it was a bounce message).

I want the from to be at the start of the line (which I get with the m option) but I do not want the scanning to span more than one line, so the entire match must be on the single line to prevent false positives.  Playing around I found I need to disable the singleline option as well.  So I currently have:

(?im-s)^from:.*<.*\.rocks>
(?im-s)^from:.*<.*\.click>

I'm going to run those and see if I capture what I expect.

I'm at bit of a loss here. One part of the question is explainable. When SpamFilter see a "(" as the first character in a line containing keywords, it expects *everything* on that line to be a RegEx. So the comma "," you used trying to specify two separate RegEx expressions on the same line will not work as you intended. It won't tell SpamFilter to separate the two RegEx expressions, rather it is interpreted as part of the RegEx.

AH!  I did it.  In real, not in testing I managed to get it working.  Here is what I ended up with.

from,((?im-s)^from:.*<.*\.rocks>),((?im-s)^to:.*<?.*\.com>?)

So the first from is just a placeholder, basically every message should have that.

Then I have two different regex that are separated with a comma.  The good news is that works!