The FROM address will often work, but not necessarily. Below is a header from a
message recently arrived in our turfdir, minus all the weird characters, that
illustrates the point. The FROM domain on this one appears to be wonderfulrewards.com,
but entering that in Message Filtering wouldn't have caught this message. What did
catch it was @YOURMAILSOURCE.COM, which, while it's all over the place in this
example, I always get from the domain in the first actual email address found in the
archive file, in this case,
<OWNER-NOLIST-2457*JOHNDOE**LANEPOWELL*[EMAIL PROTECTED]>.
om64.yourmailsource.com128.121.16.234<OWNER-NOLIST-2457*JOHNDOE**LANEPOWELL*[EMAIL PROTECTED]>c=us;a=
;p=lanepowell;l=SEA0202070923013Q83B7XCI<[EMAIL PROTECTED]>pEwLsReceived: from
om64.yourmailsource.com (128.121.16.234 [128.121.16.234]) by SEA02.LPSL.COM with SMTP
(Microsoft Exchange Internet Mail Service Version 5.5.2653.13)
id 3Q83B7XC; Tue, 9 Jul 2002 16:01:56 -0700
Received: from oc30 (oc30.yourmailsource.com) by om64.yourmailsource.com (LSMTP for
Windows NT v1.1b) with SMTP id <[EMAIL PROTECTED]>; Tue, 9 Jul 2002
18:45:50 -0400
Date: Tue, 9 Jul 2002 18:29:50 -0400
From: "Free Credit Card Search" <[EMAIL PROTECTED]>
Subject: We'll guarantee you a New Credit Card!
Reply-to: [EMAIL PROTECTED]
-Peter
-----Original Message-----
From: RBHATIA [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, July 10, 2002 15:04
To: Exchange Discussions
Subject: Turf directory
I have a question regarding the Turf directory.
In the list that I set email filtering on, let's say I'm getting email from
spammers who are spoofing the FROM email address to make it look like it's
coming from [EMAIL PROTECTED] when the actual sender is somebody else. Do I
set my filtering list to block email from [EMAIL PROTECTED] ? Will that work ?
Or do I need to find out the actual sender of the email ?
I'm running Exchange Server 5.5. SP4
Thanks
_________________________________________________________________
List posting FAQ: http://www.swinc.com/resource/exch_faq.htm
Archives: http://www.swynk.com/sitesearch/search.asp
To unsubscribe: mailto:[EMAIL PROTECTED]
Exchange List admin: [EMAIL PROTECTED]
______________________________________________
This message is private or privileged. If you are not the
person for whom this message is intended, please delete it
and notify me immediately, and please do not copy or send
this message to anyone else.
_________________________________________________________________
List posting FAQ: http://www.swinc.com/resource/exch_faq.htm
Archives: http://www.swynk.com/sitesearch/search.asp
To unsubscribe: mailto:[EMAIL PROTECTED]
Exchange List admin: [EMAIL PROTECTED]
