David W. Tamkin wrote:
Unfortunately, I'm getting legit mail lately with
Received: after From:. So far, however, there's never been
more than one Received: line following
From:, and it has always appeared immediately after From:.
I see it a lot in email from people with virtual domains.
I filter on "Received:" after Date/Subject/Reply-To as in
the following recipe.
:0f
* ^(Date|Subject|Reply-To):(.*$)+Received:
| formail -A "X-Reject: Possible forged _Received: from_ line"
--
Walter Dnes <waltdnes(_at_)interlog(_dot_)com> procmail spamfilter
http://www.interlog.com/~waltdnes/spamdunk/spamdunk.htm
Why a fiscal conservative opposes Toronto 2008 OWE-lympics
http://www.interlog.com/~waltdnes/owe-lympics/owe-lympics.htm