Hello guys,
On a postfix-amavis-spamassassin-clamd system (on Rocky Linux 8) serving
as incoming mail gateway, I would like to try the following to block
forged senders:
If From: field includes a name belonging to a list of known senders,
accept the mail only if the mail address in the same field is listed in
that list.
For example, an incoming mail arrives with a From address:
From: "John Smith" <mail1234...@gmail.com>
If my list contains:
------ /etc/amavisd/known_senders_list -------
... Smith jsm...@example.com,smi...@example.org ...
---------------------------------
then I would like to quarantine this mail as spam.
How could I do it?
As an additional/complementary/alternative approach, I would like to
check the mail body to locate the line with the name which was used in
From: field (in the above example: John Smith or J. Smith or J Smith),
and assuming this is the signature line, I would like to check the
following 5-6 lines to find whether one of them contains the name of our
organization, as an example: "ACME Productions". If it does, I would
like to ban (quarantine) the mail if the From: mail address is NOT on
the acme-productions.com domain. This test could also be assisted by a
list of Org names and respective domains. For example:
------ /etc/amavisd/known_org_list -------
... ACME Productions acme-productions.com ...
---------------------------------
The same could be done for other friendly domains (banks, mail/courier
services, etc).
How can this be done?
I am confident that we could block a good number of spam/phishing
attacks using the above logic.
Has anyone implemented the above and provide some example rules (in
amavis or in spam assassin I would presume)? What is your experience
with such approach(es)?
Thanks in advance!
Best regards,
Nick
