I tested a spam mail with the following headers:

X-Spam-Status: Yes, score=16.379 tagged_above=-1000 required=6.31 tests=[BAYES_99=3.5, DATE_IN_PAST_96_XX=2.02, HTML_MESSAGE=0.001, RCVD_IN_XBL=3.897]

~$ pcretest PCRE version 6.7 04-Jul-2006

re> /X-Spam-Status:\s*Yes,\s*(hits|score)=(\d+)\./i data> X-Spam-Status: Yes, score=16.379 tagged_above=-1000 required=6.31 0: X-Spam-Status: Yes, score=16. 1: score 2: 16

So i can say, it *should* work. A possibility may be, that another rule in my filter prevents matching, but i can't understand this, since a echo below the matching-if block is executed, which should not happen if the regex (or any previous rule) would be evaluated to true. It just behaves like the spam-detect-regex always is "false" (the variable contains neither "1" nor "0" but is completely empty) Btw, according to the maildrop manpage, i do not use non-supported features (the "i" option in pcretest was introduced by me to reflect maildrop default behavior)

What can i do now?If you're purely wishing to test for X-Spam-Status, you should
have (?:hits|score) and (?:\d+) so's not to confuse maildrop.