On Tue, Jun 24, 2008 at 12:51:30PM -0400, Charles Gregory wrote:
Lately I've seen some spam with *multiple* addresses on the
visible "From:" header of spam. Is this ever 'valid'? Or can I
safely filter out mail which lists more than one address on the
"From:" header?
My understanding is that it actually is nominally allowed per
the RFCs. However, I don't recall ever having seen it in legit
mail.
Some things are technically allowed but nevertheless 99.99% likely
to be spam indicators. Another example is the lack of whitespace
after a header name before the header field. Make what you will of that
observation.
Dallman
____________________________________________________________
procmail mailing list Procmail homepage: http://www.procmail.org/
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail