At 04:58 PM 4/20/97 -0400, Timothy J. Luoma wrote:
[snip]
I would like to dump the messages if any of these hosts are found
in any of these headers:
From
Received
From:
Message-ID:
Return-Path:
X-Sender:
Return path and From contain information dervied from the same
source. You only have to check one of the two.
The 'from' can be faked.... The Received field seems to be pretty
safe.... and I want to use the 'from's because I get updates of
known spammers daily.
I think you missed his point.
The "From " (no colon) pseudo-header and "Return-Path:" header
(if present) will both contain the *same* information. Both are
added by the receiving ISP at mail delivery time, using the
SMTP MAIL FROM information. (Yes, that can be faked, but it
will show up identically faked in both places.)
If both are available to you, checking only one will suffice.
Cheers,
Stan