I guess when it comes down to it either could be forged. If I'm going to block like this, I generally prefer to do it by IP rather than domain or email... for exactly that reason.
Does fromfile actually use something different than MAILFROM in filter tests? I didn't catch that from the manual. Darin. ----- Original Message ----- From: "Scott Fisher" <[EMAIL PROTECTED]> To: <[email protected]> Sent: Thursday, June 02, 2005 11:59 PM Subject: Re: [Declude.Virus] Newbie question I was going to suggest a fromfile. One potential problem.. the fromfile would use the enevelope from. In the case of a virus, I don't know if the envelope from would have the forged address in it. You'd have to capture some of the messages to know for sure. ----- Original Message ----- From: "Darin Cox" <[EMAIL PROTECTED]> To: <[email protected]> Sent: Thursday, June 02, 2005 5:48 PM Subject: Re: [Declude.Virus] Newbie question > You don't have to have PRO. You can also use a FROMFILE test with a text > file listing all of the email addresses and/or domains you want to > penalize. > Just put a line like this in your Global.CFG: > > FROMBLACKLIST fromfile C:\IMail\Declude\fromblacklist.txt x 200 > 0 > > This penalizes every address/domain in the fromblacklist.txt file with 200 > points. > > You'll need to add the action for the test name to the bottom of your > Global.cfg for outgoing messages, and add it to your $default$.junkmail as > well. > > Lastly, make sure you have a carriage return at the end of the > fromblacklist.txt to avoid the last line being ignored.. > > Darin. > > > ----- Original Message ----- > From: "Scott Fisher" <[EMAIL PROTECTED]> > To: <[email protected]> > Sent: Thursday, June 02, 2005 6:37 PM > Subject: Re: [Declude.Virus] Newbie question > > > If you've got pro, you could add a filter: > MAILFROM10 CONTAINS [EMAIL PROTECTED] > that will check the envelope mailfrom. > > To check for those addresses in the headers: > HEADERS 10 CONTAINS [EMAIL PROTECTED] > > Another option is to update your virus software more often to minimize the > opportunity window for the virus. > > ----- Original Message ----- > From: "Kevin Rogers" <[EMAIL PROTECTED]> > To: <[email protected]> > Sent: Thursday, June 02, 2005 5:15 PM > Subject: [Declude.Virus] Newbie question > > >> How do I ban certain email addresses? >> >> Some viruses have gotten through lately (first that I know about since >> installing Declude) sent from forged email addresses using our own >> domain. >> We do not whitelist our domain. I'd like to ban some of these common >> addresses (e.g., [EMAIL PROTECTED], [EMAIL PROTECTED], etc.) >> >> Thanks. >> >> --- >> [This E-mail was scanned for viruses.] >> >> --- >> This E-mail came from the Declude.Virus mailing list. To >> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and >> type "unsubscribe Declude.Virus". The archives can be found >> at http://www.mail-archive.com. >> > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > > --- > This E-mail came from the Declude.Virus mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.Virus". The archives can be found > at http://www.mail-archive.com. > > --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com. --- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
