blocking TLD with regex won't work even though reported as denied.

[bangkay]

Hi,

I'm trying to block a certain TLD (.co) on cpanel using a regex match. I've setup a following global email filter using from with regex matches rule:

@.*\.co$

And I've tested the filter and reported working

Sub-condition is false: not first_delivery
Condition is false: not first_delivery and error_message
Match expanded arguments:
   Subject = [email protected]
   Pattern = @.*\.co$
Condition is true: $header_from: matches @.*\\.co\$
   Condition is false: error_message
Return-path copied from sender
Sender      = [email protected]
Recipient   = [email protected]
Testing Exim filter file "/etc/vfilters/ourdomain.com"

Headers charset "UTF-8"
Fail text "REJECT"
Filtering ended by "fail".

But still being accepted by our email regardless of the email rule. Any thoughts or am I doing something wrong?

 

[cPRex]

Hey there! I'm not seeing anything obviously wrong, and the test shows that things are working well. Are there any other filters setup on the same domain that could be interfering with that behavior? Do you see any additional scanning in the /var/log/exim_mainlog file when you search for that message being read by the system?