> ## Documentation Index
> Fetch the complete documentation index at: https://docs.levelblue.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Appendix A: Wildcards and Regular Expressions

> Wildcard syntax and regular expression syntax used in MailMarshal, including shortcuts, reserved characters, examples, and map files.

MailMarshal supports a simple wildcard syntax when you enter several types of information including local domains and user groups.

MailMarshal also uses a full Regular Expression syntax for matching and substitution in Header Rewrite rules.

## Wildcard Characters

MailMarshal allows wildcard entries in the following contexts:

* Local domains. See [Running the Configuration Wizard](https://docs.levelblue.com/documentation/mailmarshal/user-guide/installing-and-configuring.md#running-the-configuration-wizard).
* User and Group matching for policy groups and rules. See [Understanding User Matching](https://docs.levelblue.com/documentation/mailmarshal/user-guide/email-policy-groups-and-rules.md#understanding-user-matching).
* Receiver HELO name matching. See [Where sender's HELO name is/is not criteria](https://docs.levelblue.com/documentation/mailmarshal/user-guide/email-policy-groups-and-rules.md#rule-conditions-for-connection-policy-rules).
* The Console search and filtering options. See [Using the MailMarshal Console for Email Management](https://docs.levelblue.com/documentation/mailmarshal/user-guide/monitoring-email-flow.md#using-the-mailmarshal-console-for-email-management).
* BTM exclusions. See [MailMarshal Properties – Advanced](https://docs.levelblue.com/documentation/mailmarshal/user-guide/managing-configuration.md#setting-advanced-options).
* Outbound TLS domains. See [Securing Outbound Communications](https://docs.levelblue.com/documentation/mailmarshal/user-guide/managing-configuration.md#securing-outbound-communications).

In each of these types of entry, MailMarshal supports this syntax:

**Table 28: Wildcard syntax**

| Character | Function |
| - | - |
| `*` | Matches any number of characters |
| `?` | Matches any single character |
| `[abc]` | Matches a single character from a b c |
| `[!abc]` or `[^abc]` | Matches a single character except a b or c |
| `[a!b^c]` | Matches a single character from a b c ! ^ |
| `[a-d]` | Matches a single character in the range from a to d inclusive |
| `[^a-z]` | Matches a single character not in the range a to z inclusive |

The table below gives some examples of results of the wildcard syntax.

**Table 29: Wildcard example results**

| Pattern | Matches |
| - | - |
| `*.ourcompany.com` | pop.ourcompany.com hq.ourcompany.com *etc.* |
| `*.mail[0-9].ourcompany.com` | mail5.ourcompany.com *but not* maila.ourcompany.com |
| `mail[!0-9].ourcompany.com` | mails.ourcompany.com *but not* mail3.ourcompany.com |

> [!NOTE]
>
> **Note:** The !, -, and ^ are special characters only if they are inside \[ ] brackets. To be a negation operator, ! or ^ must be the first character within \[ ].

## Regular Expressions

MailMarshal uses regular expressions in header matching and rewriting rules. For more information about these rules, see [Content Analysis Policy](https://docs.levelblue.com/documentation/mailmarshal/user-guide/email-policy-groups-and-rules.md#content-analysis-policy). MailMarshal also uses regular expressions in category scripts. For more information about category scripts, see the technical references "MailMarshal Anti-Spam Configuration" and "MailMarshal Advanced Anti-Spam Configuration," available from the MailMarshal support page at LevelBlue.com.

MailMarshal implements a full-featured regular expression syntax. Full documentation of this syntax is beyond the scope of this manual. For additional documentation and links to further information, see Knowledgebase article Q10520.

This appendix provides limited information about some commonly used features and some extensions specific to MailMarshal.

> [!NOTE]
>
> **Note:** MailMarshal also uses Regular Expressions in TextCensor scripts. This feature uses a different Regular Expression engine with very similar syntax to that described in this section. For more information and a link to detailed documentation, see [Anchored Regular Expressions](https://docs.levelblue.com/documentation/mailmarshal/user-guide/email-policy-elements.md#anchored-regular-expressions).

### Shortcuts

The arrow to the right of each field on the Expressions tab of the header rule panel provides access to some commonly used Regular Expression features.

**Table 30: Regular Expression shortcuts**

| Selection | Inserts | Usage |
| - | - | - |
| Any Character | `.` | Matches any single character. |
| Character in range | `[ ]` | Enter a range or set of characters to be matched within the brackets. For instance, to match lower case characters you could enter a-z between the brackets. |
| Character not in range | `[^]` | Enter a range or set of characters after the ^. Matches any character not in the set. |
| Beginning of line | `^` | Text to the right of the ^ will only match if found at the beginning of the line. |
| End of line | `$` | Text to the left of the \$ will only match if found at the end of the line. |
| Tagged expression | `( )` | The content within the parentheses will be considered as a single expression for repeat purposes. This expression will be saved for use within the substitution field. |
| Or | `\|` | The field will be matched if it matches either the expression before the \| or the expression after the \|. |
| 0 or more matches | `*` | The expression before the \* will be matched if it is repeated any number of times, including zero. |
| 1 or more matches | `+` | The expression before the + will be matched if it is repeated at least once. |
| Repeat | `{ }` | Enter a number or two numbers separated by a comma within the braces. The expression before the braces will be matched if it is repeated the number of times specified. See [Repeat Operators](#repeat-operators). |
| Whitespace | `[[:space:]]` | Matches a single whitespace character (space, tab, and so on.). |
| Alphanumeric character | `[[:alnum:]]` | Matches a single letter or number character. |
| Alphabetic character | `[[:alpha:]]` | Matches a single letter character. |
| Decimal digit | `[[:digit:]]` | Matches a single number character 0-9. |

### Reserved Characters

Some characters have special meanings within regular expressions.

#### Operators

The following characters are reserved as regular expression operators:

```text theme={null}
* . ? + ( ) { } [ ] $ \ | ^ <
```

To match any of these characters literally, precede it with `\`

For example, to match `marshal.com` enter `Marshal\.com`

#### Wildcard Character .

The dot character (`.`) matches any single character.

#### Repeat Operators

A repeat is an expression that occurs an arbitrary number of times. The repeat operators are `*`, `+`, `?`, and `{}`.

An expression followed by `*` can be present any number of times, including zero. An expression followed by `+` can be present any number of times, but must occur at least once. An expression followed by `?` may occur zero times or once only. You can specify a precise range of repeated occurrences as a comma-separated pair of numbers within `{}`. For instance,

* `ba*` will match b, ba, baaa, etc.
* `ba+` will match ba or baaaa for example but not b.
* `ba?` will match b or ba.
* `ba{2,4}` will match baa, baaa and baaaa.

#### Parentheses ( )

Parentheses serve two purposes:

* To group items together into a sub-expression. You can apply repeat operators to sub-expressions in order to search for repeated text.
* To mark a sub-expression that generated a match, so it can be used later for substitution.

For example, the expression `(ab)*` would match all of the string

```text theme={null}
ababab
```

The expression "ab" would be available in a variable (tagged expression) with a name in the range $1...$9 (see the matching and substitution examples in following sections).

#### Alternatives

Alternatives occur when the expression can match either one sub-expression or another. In this case, each alternative is separated by a `|`. Each alternative is the largest possible previous sub-expression (this is the opposite to repetition operator behavior).

* `a(b|c)` could match ab or ac
* `abc|def` could match abc or def

### Examples

The following sections show examples of matching and substitution strings.

#### Matching

The expression

```text theme={null}
(.+)@(.+)\.ourcompany\.com$
```

will match a sequence of 1 or more characters followed by an @ followed by another sequence of 1 or more characters, followed by `.ourcompany.com` at the end of the field.

That is, it will match [john@host.ourcompany.com](mailto:john@host.ourcompany.com) and [john.smith@host.subdomain.ourcompany.com](mailto:john.smith@host.subdomain.ourcompany.com) but not [peter@host.ourcompany.com.au](mailto:peter@host.ourcompany.com.au)

#### Substitution

Using the example given in the preceding section, the substitution expression

```text theme={null}
$1@$2.co.uk.eu
```

would yield [john@host.co.uk.eu](mailto:john@host.co.uk.eu), [john.smith@host.subdomain.co.uk.eu](mailto:john.smith@host.subdomain.co.uk.eu) and [peter@host.ourcompany.com.au](mailto:peter@host.ourcompany.com.au) respectively. The last result may be somewhat surprising, but data that does not match part of the regular expression is simply copied across.

### Map Files

MailMarshal allows substitution using regular expressions to search for an entry in text file known as a map file. Each line in the map file contains two values separated by a comma. If the search expression matches the first value in a line, MailMarshal substitutes the second value. If the search expression does not match the first value in any line, MailMarshal substitutes the search expression.

A typical use of map files is to redirect incoming email to arbitrary addresses. The following simple example modifies email addresses using a map file.

#### Map file

```text theme={null}
john@domain.co.uk, john@domain2.co.uk
peter@domain.co.uk, peter@host1.domain.co.uk
```

#### Search expression

```text theme={null}
(.+)@domain\.co\.uk$
```

#### Lookup key

```text theme={null}
$1@domain.co.uk
```

#### Sample results

The following table shows the matching addresses when the sample mapping file above is used.

**Table 31: Map file example results**

| Input Email Address | Result |
| - | - |
| [john@domain.co.uk](mailto:john@domain.co.uk) | [john@domain2.co.uk](mailto:john@domain2.co.uk) |
| [peter@domain.co.uk](mailto:peter@domain.co.uk) | [peter@host1.domain.co.uk](mailto:peter@host1.domain.co.uk) |
| [alice@domain.co.uk](mailto:alice@domain.co.uk) | [alice@domain.co.uk](mailto:alice@domain.co.uk) |