Also known as Adventures in the Spam Filter chapter 3
the spam filter uses regex for any conditionally matching string you put into it, you don't select if you want a literal string or regex
So if I make a whitelist entry for, say, "dor.mo.gov", the Missouri Department of Revenue's website (and also the domain they send emails from), oops, "." is regex's wildcard character, so that also means a sender like "dorFmoUgov" gets through on the same whitelist rule
I'm going to have to go back and escape a shitload of periods