I'm trying to use malquery to find all e-mails sent to either of threee recipients. It looks like malquery processes multiple -e options as ANDed.
e.g. malquery -p 30d -e RCPTS=bob@yahoo.com -e RCPTS=Alice@hotmail.com -e RCPTS=glen@gmail.com Only seems to return e-mails where bob, alice and glen are ALL recipients. thoughts?
yes, multiple -e options is AND in between.
Why don't you try run 3 times?