Ruleset questions

[Lars Kristiansen]

Richard Frovarp skrev:
> Glenn Steen wrote:
>>
>>> SPF wouldn't do it. SPF would only check the envelope from. We are 
>>> concerned
>>> about the displayed from. And in particular of only one of our accounts.
>>>     
>>
>> Ah. Well, the same goes for my little thing. I think you'll have to
>> look at some SA rule creation, it is the best tool for the job.
>> MailScanner rulesets are out of the question too, since they only
>> operate on the envelope info too. Same for BLs and such.
>> So SA it is.
>>
>>   
> Thanks for the information. Trying to look at how to reduce the number 
> of social engineering attacks against our users using our own help desk 
> email address (not like they aren't successful using any other email 
> address out there anyway). So the visible From from the headers is what 
> matters here.
> 
> Richard


FWIW: DKIM operates on From header if not Sender header is present.

Regards,
  Lars