How to reject/detect emails claiming to be from my own domain?

[Mark Sapiro]

On 12/29/2016 10:12 AM, Philip Parsons wrote:
> Any chance you have an example ?

You said:
>> The rule set from 
>> Thom van der Boon works great on the From header.


By that I assume you meant (from
<http://lists.mailscanner.info/pipermail/mailscanner/2016-December/104206.html>)

> header __DSR_DOMAINCOM_VALID000 From =~ /\@domain.com/i 
> header __DSR_DOMAINCOM_VALID001 To =~ /\@domain.com/i 
> ifplugin Mail::SpamAssassin::Plugin::DKIM 
> meta DSR_DOMAINCOM_VALID __DSR_DOMAINCOM_VALID000 && __DSR_DOMAINCOM_VALID001 && !DKIM_VALID 
> else 
> meta DSR_DOMAINCOM_VALID __DSR_DOMAINCOM_VALID000 && __DSR_DOMAINCOM_VALID001 
> endif 
> describe DSR_DOMAINCOM_VALID No valid domain.com mail 
> score DSR_DOMAINCOM_VALID 20.O

All you need to do to make that work with the envelope sender instead of
From: is change the first line to

header __DSR_DOMAINCOM_VALID000 Return-Path =~ /\@domain.com/i

-- 
Mark Sapiro <mark at msapiro.net>        The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan