Hi all,
I hope someone can help me with a rule I'm trying to write. My understanding of the multi-line mode, with the /m switch at the end,
is this: in this mode, the caret (^) and dollar ($) match before and after newlines in the string. Is that correct?

I believe this is the correct method for allowing me to use a "full" rule (ie. searching the entire undecoded message) but also
specifying carets and dollars within the regex, right?

So I think this should mean that I can have some text like this, for example:

Subject: this is a test
From: blah@example.com
X-Return-Path: blah@example.com

....and create a rule like the following which should hit on it:

full MYRULE /^Subject:.* test$(?:\s(?!X-Return-Path).*)+\sX-Return-Path: blah\@example\.com/m

Right? If I test this rule using the Regex Coach tool at http://weitz.de/regex-coach/ (I'm on Windows), with the 'm' switch enabled,
the rule works fine. But when I test it with SpamAssassin, it doesn't work and I believe it's due to the carat and dollar.

However I want to specifically specify that the word "test" must be at the very end of the Subject line - hence, I want to have the
$ after it. I also want to specify that the X-Return-Path must be there, which is why I have the rest of the rule the way it is, but
that's not the issue.

What am I doing wrong?

(Of course in reality I'm not searching for the above strings, I'm trying to catch a particular spam sign, but this is a simple
example of the method I'm using)

Cheers,
Jeremy