DoNoFromSelect text says:
Select which check should be done in DoNoFrom .
1 - from: and sender: header tag are both missing
2 - different domains found in from: and sender: email addresses - or multiple
addresses in a single header (FROM: or SENDER:) of different domains are found
4 - multiple from: addresses or from: header tags found (potential 2x score if
option 2 is also enabled)
8 - multiple sender: addresses or sender: header tags found (potential 2x score
if option 2 is also enabled)
16 - no or an invalid email address found in from: header tag
32 - no or an invalid email address found in sender: header tag
Simply form the sum of the numbers in front of the checks you want to select
(0...63). Default vaule is 59 (1+2+8+16+32) - all checks are selected.
Last sentence:
1. ‘vaule’ should be ‘value’.
2. My value was 63 (not sure why) and today I got lots of blocks from the
Clamav mailing list for different from and sender addresses. This is pretty
normal for mailing lists, isn’t it?
host and sender authentications:
host '[10.124.241.7] (7.241.124.10 <>)' authenticated to 'w01.nimastelecom.com'
using 'ESMTPSA'
sender and reply addresses:
MAIL FROM: clamav-users-boun...@lists.clamav.net <>
From: carlos.vela...@nimastelecom.com <>
List-Unsubscribe: clamav-users-requ...@lists.clamav.net <>
List-Post: clamav-us...@lists.clamav.net <>
List-Help: clamav-users-requ...@lists.clamav.net <>
List-Subscribe: clamav-users-requ...@lists.clamav.net <>
Reply-To: clamav-us...@lists.clamav.net <>
Errors-To: clamav-users-boun...@lists.clamav.net <>
Sender: clamav-users-boun...@lists.clamav.net <>
recipient addresses:
RCPT TO: jlbr...@bordo.com.au <>
To: clamav-us...@lists.clamav.net <>
using enhanced Originated IP detection for all IP addresses
•detected IP's on the mail routing way: 80.28.132.236 <>(w01.nimastelecom.com)
•detected source IP: 80.28.132.236 <>
Subject: [clamav-users] Unable to compile 0.102.0 -
/usr/lib64/../lib/libstdc++.so
Feature Matching:
• On Global Whitelist <http://localhost:55555/lists>:
'clamav-users-boun...@lists.clamav.net' <>
• On Global Whitelist <http://localhost:55555/lists>:
'clamav-users-requ...@lists.clamav.net' <>
• On Global Whitelist <http://localhost:55555/lists>:
'clamav-us...@lists.clamav.net' <>
• DoNoFrom <http://localhost:55555/#DoNoFrom>: detected (1) faults in scoring
mode - last reason: found (2) different sender domains in 'From:' and 'Sender:'
header tags ( DoNoFrom ) - penalty: 1 * 45 = 45
Will change the value from 63 to 61.
Regards,
James.
_______________________________________________
Assp-test mailing list
Assp-test@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/assp-test
