Forged FROM address in my domain

Jan-Peter Koopmann Jan-Peter.Koopmann at SECEIDOS.DE
Tue Nov 25 14:13:08 GMT 2003

> I am getting quite a lot of Spam getting through which has a 
> forged FROM address using a spurious user name in our own 
> domain. Is there any easy way to say If From is *@my.domain 
> and IP address is not my IP subnet then message 'Is Definitely Spam'?

You could do this in your MTA probably and therefore block it completly.
The question remains: Do you really want to do this? I would start
looking why the spam is coming through MailScanner and SpamAssassin in
the first place and try to optimize things there.


More information about the MailScanner mailing list