procmail
[Top] [All Lists]

Re: filter this type of spam: From: "Rene Snider"@fruitcom.com

2007-10-22 10:53:22
At 11:21 2007-10-22 +0200, Eric Smith wrote:
What is the regex?

Someone else has already addressed matching the quote before the domain, 
but along those lines, it does certainly seem like your MTA is inserting 
the local domain into the From: header.

You might consider examining the relay hosts through which the message was 
passed, and comparing that against legitimate hosts which should be 
originating a message from your domain.  Note that you could have 
legitimate messages coming via discussion lists, so rejecting simply 
because the address is at your domain, but the relay isn't, is not itself a 
good practice.

---
  Sean B. Straw / Professional Software Engineering

  Procmail disclaimer: <http://www.professional.org/procmail/disclaimer.html>
  Please DO NOT carbon me on list replies.  I'll get my copy from the list.
____________________________________________________________
procmail mailing list   Procmail homepage: http://www.procmail.org/
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail

<Prev in Thread] Current Thread [Next in Thread>