Reject or tag email signed with @mydomain.com

[Matt Kettler]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Matt Kettler wrote:
> Hancock, Scott wrote:
> 
>>SA 3.0 - will look at the header.  Do I write a custom rule?
> 
> 
> You could, it would have to be a group of 3 rules, 1 checks the received to see
> if it's your domain, 1 checks the from to see if it is your domain, and a meta
> rule that fires if the from matches but received doesn't.

For reference, a simple rule to this effect would look something like this:

header _L_FROM_EVI              From =~/\@.{0,15}evi-inc\.com/
header _L_RCVD_EVI              Received =~/\.evi-inc\.com\b/
meta L_FORGED_EVI       (_L_FROM_EVI && ! _L_RCVD_EVI)


But the received check probably needs considerable refinement. (ie: look for
that to be the "from" part of a Received: header, as it will probably FN due to
matching the "by" part of the header)

However, that's a start for you..

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!