Just got a spam mail that lacked a "From:" line in the header.
The only meaningful headers it had at all were 2 received lines and a
message-id. The only valid information in all of that was the
original mailer site.
Anyway, it started me thinking of a way to easily catch this.
My first idea was basically:
:0
* !^From:
/dev/null
but this is clearly not right. So ...
NOFROM=1
:0
* ^From:
NOFROM=0
(continue processing)
:0
* $NOFROM
/dev/null
I'll look up the exact syntax for doing this if need be; right now
I'm just wondering if this is the best way to do this in procmail.
I've looked through all of the anti-spam procmail web pages that I
could find, and none of them mention techniques for catching
From:-less spam.
Thanks!
-jeff
-----
The above thoughts are mine and are not representative of Learjet.