#\N^user@domain\.tld<@>.+$\N$	: ok
#*<@>1.2.3.4			: ok
#\N^.+<@>1\.2\.3\..+$\N		: defer : SMTP authentication is restricted : SMTP authentication from 1.2.3.0/24 is deferred
#*<@>UA				: ok
#*<@>DE				: ok

##\N^.+<@>(CN|BR|KR)$		: defer : Using of SMTP authentication is restricted : SMTP authentication as $authenticated_id from host ${if eq{$sender_host_name}{}{}{$sender_host_name }}[$sender_host_address] (ASN=$acl_c_sender_host_address_asn; country=$acl_c_sender_host_address_country; continent=$acl_c_sender_host_address_continent)${if eq{$received_port}{-1}{}{ on ${received_ip_address}:${received_port}}}${if eq{$tls_cipher}{}{}{ ($tls_cipher)}} denied
#\N^.+<@>(CN|BR|KR)$		: defer : Using of SMTP authentication is restricted : SMTP authentication as $authenticated_id from host ${if eq{$sender_host_name}{}{}{$sender_host_name }}[$sender_host_address] (ASN=$acl_c_sender_host_address_asn; country=$acl_c_sender_host_address_country; continent=$acl_c_sender_host_address_continent)${if eq{$received_port}{-1}{}{ on ${received_ip_address}\x3a${received_port}}}${if eq{$tls_cipher}{}{}{ (${sg{$tls_cipher}{\3a}{\x5cx5cx3a}})}} denied

##\N^.+<@>[A-Z]{2}$		: warn : SMTP authentication attempt detected : SMTP authentication attempt as $authenticated_id from host ${if eq{$sender_host_name}{}{}{$sender_host_name }}[$sender_host_address] (ASN=$acl_c_sender_host_address_asn; country=$acl_c_sender_host_address_country; continent=$acl_c_sender_host_address_continent)${if eq{$received_port}{-1}{}{ on ${received_ip_address}:${received_port}}}${if eq{$tls_cipher}{}{}{ ($tls_cipher)}} detected
#\N^.+<@>[A-Z]{2}$		: warn : SMTP authentication attempt detected : SMTP authentication attempt as $authenticated_id from host ${if eq{$sender_host_name}{}{}{$sender_host_name }}[$sender_host_address] (ASN=$acl_c_sender_host_address_asn; country=$acl_c_sender_host_address_country; continent=$acl_c_sender_host_address_continent)${if eq{$received_port}{-1}{}{ on ${received_ip_address}\x3a${received_port}}}${if eq{$tls_cipher}{}{}{ (${sg{$tls_cipher}{\3a}{\x5cx5cx3a}})}} detected

##\N^.+<@>[A-Z]{2}(,[A-Z]{2})*$	: warn : SMTP authentication attempt detected : SMTP authentication attempt as $authenticated_id from host ${if eq{$sender_host_name}{}{}{$sender_host_name }}[$sender_host_address] (ASN=$acl_c_sender_host_address_asn; country=$acl_c_sender_host_address_country; continent=$acl_c_sender_host_address_continent)${if eq{$received_port}{-1}{}{ on ${received_ip_address}:${received_port}}}${if eq{$tls_cipher}{}{}{ ($tls_cipher)}} detected
\N^.+<@>[A-Z]{2}(,[A-Z]{2})*$	: warn : SMTP authentication attempt detected : SMTP authentication attempt as $authenticated_id from host ${if eq{$sender_host_name}{}{}{$sender_host_name }}[$sender_host_address] (ASN=$acl_c_sender_host_address_asn; country=$acl_c_sender_host_address_country; continent=$acl_c_sender_host_address_continent)${if eq{$received_port}{-1}{}{ on ${received_ip_address}\x3a${received_port}}}${if eq{$tls_cipher}{}{}{ (${sg{$tls_cipher}{\3a}{\x5cx5cx3a}})}} detected

##\N^.+<@>[A-Z]{2}(,[A-Z]{2})*$	: ${if match{$tls_cipher}{\N^TLS1:\N}{defer : Using of SMTP authentication is restricted : SMTP authentication as $acl_c_auth_relay_auth_id from host ${if eq{$acl_c_sender_host_name}{}{}{$acl_c_sender_host_name }}[$sender_host_address] (ASN=$acl_c_sender_host_address_asn; country=$acl_c_sender_host_address_country; continent=$acl_c_sender_host_address_continent)${if eq{$received_port}{-1}{}{ on ${received_ip_address}:${received_port}}}${if eq{$tls_cipher}{}{}{ ($tls_cipher)}} is restricted due to TLS version}{warn : SMTP authentication attempt detected : SMTP authentication attempt as $acl_c_auth_relay_auth_id from host ${if eq{$acl_c_sender_host_name}{}{}{$acl_c_sender_host_name }}[$sender_host_address] (ASN=$acl_c_sender_host_address_asn; country=$acl_c_sender_host_address_country; continent=$acl_c_sender_host_address_continent)${if eq{$received_port}{-1}{}{ on ${received_ip_address}:${received_port}}}${if eq{$tls_cipher}{}{}{ ($tls_cipher)}} detected}}
#\N^.+<@>[A-Z]{2}(,[A-Z]{2})*$	: ${if match{$tls_cipher}{\N^TLS1:\N}{defer : Using of SMTP authentication is restricted : SMTP authentication as $acl_c_auth_relay_auth_id from host ${if eq{$acl_c_sender_host_name}{}{}{$acl_c_sender_host_name }}[$sender_host_address] (ASN=$acl_c_sender_host_address_asn; country=$acl_c_sender_host_address_country; continent=$acl_c_sender_host_address_continent)${if eq{$received_port}{-1}{}{ on ${received_ip_address}\x5cx3a${received_port}}}${if eq{$tls_cipher}{}{}{ (${sg{$tls_cipher}{:}{\x5cx5cx3a}})}} is restricted due to TLS version}{warn : SMTP authentication attempt detected : SMTP authentication attempt as $acl_c_auth_relay_auth_id from host ${if eq{$acl_c_sender_host_name}{}{}{$acl_c_sender_host_name }}[$sender_host_address] (ASN=$acl_c_sender_host_address_asn; country=$acl_c_sender_host_address_country; continent=$acl_c_sender_host_address_continent)${if eq{$received_port}{-1}{}{ on ${received_ip_address}\x5cx3a${received_port}}}${if eq{$tls_cipher}{}{}{ (${sg{$tls_cipher}{:}{\x5cx5cx3a}})}} detected}}