>I'm trying to add a filter to the header_checks file to identify and block >messages with obviously forged return addresses, such as things that look >like this: > >Received: from yahoo.com (unknown [206.44.1.9]) > >The filter I've added for this is: > >/yahoo.com \(unknown \[2/ REJECT Forged yahoo address
Do this with monkey's "frequently forged domains" file and "reject_unknown_client". This verifies that the sending ip has matching A and PTR records, where 206.44.1.9 doesn't. Additional forgery protection comes from the new reject_unverified_sender. Len
