How to do NOT in email filter?

[Wallaby]

I want to be able to say:

If the headers do NOT contain Special-String then Discard

in an email filter. Regex is I'm sure the way to go:

Filter ... Any Header .. that ... matches regex ... ???? Destination ... Discard

but I'm not familiar with designing regex expressions. Can anyone help?

EDIT: Actually, thinking this through, what I want to say is "if NONE of the headers contain Special-String..."

The application is this: mail is passed through an antispam device before it arrives at the CPanel server. The device adds a certain header to mail that it processes. However, some spammers ignore the MX record and mail direct to the main domain IP, hence bypassing the antispam device. I want to ensure that only mail that:

a) Was sent from the antispam device, or

b) Originates on the same server the domain is hosted on

gets accepted.

Ideas welcome!

 

[HostIt]

AFAIK you'd want to edit the /etc/vfilters/domain.com file to something along the lines of the following. Beware that cPanel may overwrite the custom command if the filters are subsequently edited via the cPanel interface, as it doesn't deal with "does not contain" at this point in time. I'm not sure there's any danger of the file being overwritten under other circumstances, for example a nightly update etc, but I'm about to try this myself.

if
 $message_headers does not contain "Special-String"
then
 save "/dev/null" 660
endif