Reject or tag email signed with

Matt Kettler mkettler at EVI-INC.COM
Wed Jul 13 16:42:12 IST 2005

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Matt Kettler wrote:
> Hancock, Scott wrote:
>>SA 3.0 - will look at the header.  Do I write a custom rule?
> You could, it would have to be a group of 3 rules, 1 checks the received to see
> if it's your domain, 1 checks the from to see if it is your domain, and a meta
> rule that fires if the from matches but received doesn't.

For reference, a simple rule to this effect would look something like this:

header _L_FROM_EVI              From =~/\@.{0,15}evi-inc\.com/
header _L_RCVD_EVI              Received =~/\.evi-inc\.com\b/
meta L_FORGED_EVI       (_L_FROM_EVI && ! _L_RCVD_EVI)

But the received check probably needs considerable refinement. (ie: look for
that to be the "from" part of a Received: header, as it will probably FN due to
matching the "by" part of the header)

However, that's a start for you..

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki ( and
the archives (

Support MailScanner development - buy the book off the website!

More information about the MailScanner mailing list