No subject

match are the same.

Rule format I can think of is

FromTo: emailid or IP,emailid or IP. If second arguement exists, the AND
operator applies, if not OR.

Mohan
-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK]On
Behalf Of Rob V
Sent: Wednesday, July 16, 2003 9:42 PM
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: Re: forged From:


Can I add that in my scan.rules ?
like
From:           192.168.198.    no

will that no scan all of 192.168.198
or do I have to add it differently ?



At 03:08 PM 7/16/2003 +0100, you wrote:
>Rob V wrote:
> > Has Anyone got a way to block or detect a forged From: address.
> > I am getting spam sent to us with forged From (they are putting that
> > the mail is from someone at our domain)
> > Since we do not scan our own domain these messages are getting in no
> > problem. Any help or suggested would be appreciated.
>
>You should not whitelist your own domains by their domain name, instead
>you should whitelist trusted internal servers by IP, or your IP address
blocks.
>
>
>
>BMRB International
>http://www.bmrb.co.uk
>+44 (0)20 8566 5000
>_________________________________________________________________
>This message (and any attachment) is intended only for the
>recipient and may contain confidential and/or privileged
>material.  If you have received this in error, please contact the
>sender and delete this message immediately.  Disclosure, copying
>or other action taken in respect of this email or in
>reliance on it is prohibited.  BMRB International Limited
>accepts no liability in relation to any personal emails, or
>content of any email which does not directly relate to our
>business.

Rob Vicchiullo
robv at disaster.com
http://www.disaster.com
(518) 218-0900