On 18 Feb, Professional Software Engineering wrote:
| [...]
|
| Things like spammish domains (optin, direct, email, etc), spammish email
| addresses (sales, marketing, info, bizop, remove, etc), mismatching From:
| and envelope (should really only be that way on list messages and you've
| either pre-filtered those or given them a score adjustment for being a
| recognized list origin), skewed date (in the future, or very old), and a
| variety of other characteristics can all add up very quickly from seemingly
| insignificant values to a rather obvious indicator of spammishness.
Although I filter on discrepancies between Envelope and From: header,
there are legitimate exceptions -- me. I use aliases and change the
From: header on a large percentage of my outgoing messages. Right now,
my mail client is a little long of tooth and isn't capable of changing
envelope sender on the fly (and doesn't look at sendmail's
genericstable), so most of my messages have a mismatched sender.
They're different user names but the domain is the same. I'm testing
an upgrade that will be able to modify the envelope but, even when I
start with it, I'm considering staying with a constant envelope sender
anyway.
I'm not suggesting this is a frequent occurrence, or even one that
should be allowed for in filters, just that there are legitimate
exceptions. I've also been known to use gentle persuasion to get friends
and family (non-spammers) to change their email habits so they quit
looking like spammers. If this is perceived as a silver bullet kind of
spam characteristic, I'll consider changing it.
--
Email address in From: header is valid * but only for a couple of days *
This is my reluctant response to spammers' unrelenting address harvesting
_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail