In message
<Pine(_dot_)GSO(_dot_)4(_dot_)05(_dot_)10806241249540(_dot_)5425-100000(_at_)james(_dot_)hwcn(_dot_)org>,
Charles Gregory (cgregory(_at_)hwcn(_dot_)org) wrote:
I suppose I could dig through RFC's, but I'm feeling lazy, and I'm sure
someone knows this right off the top of their head.
Lately I've seen some spam with *multiple* addresses on the visible
"From:" header of spam. Is this ever 'valid'? Or can I safely filter out
mail which lists more than one address on the "From:" header?
Good question and one I thought I knew the answer to, but I appear to
have been wrong!
http://www.ietf.org/rfc/rfc2822.txt
"3.6.2. Originator fields
The originator fields of a message consist of the from field, the
sender field (when applicable), and optionally the reply-to field.
The from field consists of the field name "From" and a
comma-separated list of one or more mailbox specifications. If the
from field contains more than one mailbox specification in the
mailbox-list, then the sender field, containing the field name
"Sender" and a single mailbox specification, MUST appear in the
message. In either case, an optional reply-to field MAY also be
included, which contains the field name "Reply-To" and a
comma-separated list of one or more addresses.
from = "From:" mailbox-list CRLF
sender = "Sender:" mailbox CRLF
reply-to = "Reply-To:" address-list CRLF
The originator fields indicate the mailbox(es) of the source of the
message. The "From:" field specifies the author(s) of the message,
that is, the mailbox(es) of the person(s) or system(s) responsible
for the writing of the message."
There is more, but basically it says there may be more than one
address.
Cheers,
Nick.
--
____________________________________________________________
procmail mailing list Procmail homepage: http://www.procmail.org/
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail