I need that all messages, which were going through backup server by provider should finish in the spam quarantine.
I have IP addresses (cluster) of the last relay(s) (they are like the smtp backup servers - secondary in mx record) and their name "bmx.cz.net", which I see in the smtp header. How to create the rule to finish the messages from this server (many servers in cluster) in the spam quarantine please?
The problem is, that the text in the header can contain this text also from the previous communications, in despite that we need two conditions:
1) IP addresses, which contact our SMG.
2) Text in the header "Received:" with the value "bmx.cz.net".
It is not possible to do per Reputation (in this section I have other action).
Any idea please?
Thank you.
PaJi