From = to

[Antony Stone]

On Friday 18 July 2003 9:57 pm, Alan Fiebig wrote:

> We see a number of spams coming in where the 'From:' address has been set
> by the spammer to be the same as the 'To:' address. When MS detects these,
> a bounce message typically consisting of the 'Sender Spamassassin Report',
> it sends the bounce message to the spam's 'From:' address. As the 'From:'
> was forged to be the same as the intended recepient of the spam, its that
> poor recepient who gets the bounce message.
>
> They quickly in turn email us screaming "I didn't send out that spam,
> especially not to myself!"
>
> So, what I'm looking for is some means of bypassing the 'bounce' action
> anytime the 'From:' or the 'Rely to:' is the same as the 'To:' address.
>
> Any ideas?

Is there any mileage in creating yourself a SpamAssassin rule which picks up
on From=To, and assigning it a high enough score that it reaches your
MailScanner High Spam Score, which you can then delete?

Antony.

--

The truth is rarely pure, and never simple.

 - Oscar Wilde