From mailscanner at barendse.to  Thu Mar  5 14:16:07 2020
From: mailscanner at barendse.to (Remco Barendse)
Date: Thu, 5 Mar 2020 15:16:07 +0100 (CET)
Subject: Flag messages where reply-to is different from the sender?
Message-ID: <alpine.LRH.2.21.2003051514210.29948@raveon.vaag.nu>

Hi list!

Is there any way to raise a red flag for emails where the reply-to address 
is different from the original sender ?

See this being used for fraud attempts.....

Thanks!

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.


From mailscanner at replies.cyways.com  Thu Mar  5 15:31:12 2020
From: mailscanner at replies.cyways.com (Peter H. Lemieux)
Date: Thu, 5 Mar 2020 10:31:12 -0500
Subject: Flag messages where reply-to is different from the sender?
In-Reply-To: <alpine.LRH.2.21.2003051514210.29948@raveon.vaag.nu>
References: <alpine.LRH.2.21.2003051514210.29948@raveon.vaag.nu>
Message-ID: <b752075b-a8df-5532-c519-a369844e1dc4@replies.cyways.com>

If you have users who subscribe to listservers, I'd be wary about this. 
Often the Reply-To points to the listserver address while the From uses 
the sender's address.

SpamAssassin lets you write rules that key on multiple features of a 
message.  You could look into that.

Peter


On 3/5/20 9:16 AM, Remco Barendse wrote:
> Is there any way to raise a red flag for emails where the reply-to 
> address is different from the original sender ?



From john at wilcock.fr  Thu Mar  5 15:04:51 2020
From: john at wilcock.fr (John Wilcock)
Date: Thu, 05 Mar 2020 16:04:51 +0100
Subject: Flag messages where reply-to is different from the sender?
In-Reply-To: <alpine.LRH.2.21.2003051514210.29948@raveon.vaag.nu>
References: <alpine.LRH.2.21.2003051514210.29948@raveon.vaag.nu>
Message-ID: <f680d86e0650fb04aabd54f36a673e67@wilcock.fr>

It can be done in various ways in Spamassassin, but beware that there 
are plenty of legitimate uses with different Reply-to:, such as this:  
:-)

> From: Remco Barendse <mailscanner at barendse.to>
> Reply-To: MailScanner Discussion <mailscanner at lists.mailscanner.info>
> Sender: "MailScanner" 
> <mailscanner-bounces+john=wilcock.fr at lists.mailscanner.info>


-- 
John

On 2020-03-05 15:16, Remco Barendse wrote:

> Hi list!
> 
> Is there any way to raise a red flag for emails where the reply-to 
> address is different from the original sender ?
> 
> See this being used for fraud attempts.....
> 
> Thanks!
> 
> --
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.

From mailscanner at barendse.to  Thu Mar  5 16:33:19 2020
From: mailscanner at barendse.to (Remco Barendse)
Date: Thu, 5 Mar 2020 17:33:19 +0100 (CET)
Subject: Flag messages where reply-to is different from the sender?
In-Reply-To: <f680d86e0650fb04aabd54f36a673e67@wilcock.fr>
References: <alpine.LRH.2.21.2003051514210.29948@raveon.vaag.nu>
 <f680d86e0650fb04aabd54f36a673e67@wilcock.fr>
Message-ID: <alpine.LRH.2.21.2003051722370.29948@raveon.vaag.nu>

I know, I'd just like it to raise a red flag or banner somewhere. In 
corporate environments, i see reply-to hardly being used

Think it's a similar red flag like 'emails originating outside the 
organization'   (speaking of which can MailScanner flag that at the top of 
an email rather than at the bottom?)



On Thu, 5 Mar 2020, John Wilcock wrote:

> It can be done in various ways in Spamassassin, but beware that there are 
> plenty of legitimate uses with different Reply-to:, such as this:  :-)
>
>>  From: Remco Barendse <mailscanner at barendse.to>
>>  Reply-To: MailScanner Discussion <mailscanner at lists.mailscanner.info>
>>  Sender: "MailScanner"
>>  <mailscanner-bounces+john=wilcock.fr at lists.mailscanner.info>
>
>
> -- 
> John
>
> On 2020-03-05 15:16, Remco Barendse wrote:
>
>>  Hi list!
>>
>>  Is there any way to raise a red flag for emails where the reply-to address
>>  is different from the original sender ?
>>
>>  See this being used for fraud attempts.....
>>
>>  Thanks!
>>
>>  --
>>  This message has been scanned for viruses and
>>  dangerous content by MailScanner, and is
>>  believed to be clean.
>
>
> -- 
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
>
> -- 
> This message has been scanned for viruses and
> dangerous content by MailScanner, and is
> believed to be clean.
>
>

-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.


From danita at caledonia.net  Wed Mar 18 10:31:09 2020
From: danita at caledonia.net (Danita Zanre)
Date: Wed, 18 Mar 2020 11:31:09 +0100
Subject: Allow winmail.dat for one sender?
Message-ID: <7cfc4d3d-f3b4-8e09-a75f-60b8b2f3e1c9@caledonia.net>

I'm struggling with this.? I've read all of the examples in the rules 
directory, but I'm just not having any luck getting this to work.

We have one vendor who sends invoices through an automated system, and 
they come in as winmail.dat files and get blocked.? We can release them 
of course, but it's an annoyance.? I'm trying to allow just this sender 
to get these messages through.? Can someone hold my hand here please?

Thanks!

-- 
*Danita Zanr?*
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20200318/0f6c456b/attachment.html>

From ryan.virgo at gmail.com  Wed Mar 18 12:16:01 2020
From: ryan.virgo at gmail.com (Ryan Braganza)
Date: Wed, 18 Mar 2020 17:46:01 +0530
Subject: Allow winmail.dat for one sender?
In-Reply-To: <7cfc4d3d-f3b4-8e09-a75f-60b8b2f3e1c9@caledonia.net>
References: <7cfc4d3d-f3b4-8e09-a75f-60b8b2f3e1c9@caledonia.net>
Message-ID: <CAEaVHLUizNqc6yXvzdSpXqYdZNG-2L7j-NAf5G4iYZpfoeQB4A@mail.gmail.com>

Have a look here

http://lists.mailscanner.info/pipermail/mailscanner/2011-November/098911.html

On Wed, Mar 18, 2020 at 4:01 PM Danita Zanre <danita at caledonia.net> wrote:

> I'm struggling with this.  I've read all of the examples in the rules
> directory, but I'm just not having any luck getting this to work.
>
> We have one vendor who sends invoices through an automated system, and
> they come in as winmail.dat files and get blocked.  We can release them of
> course, but it's an annoyance.  I'm trying to allow just this sender to get
> these messages through.  Can someone hold my hand here please?
>
> Thanks!
>
> --
> *Danita Zanr?*
>
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
>

-- 
--------------------------------------------------------------------------------------------------------------------------------------
*?*
*Race the rain, Ride the wind & Chase the sunset. Only a biker understands.**?
*
--------------------------------------------------------------------------------------------------------------------------------------
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.mailscanner.info/pipermail/mailscanner/attachments/20200318/64d136f4/attachment.html>