Here we go:
if !/^DKIM-Signature:/
/^From:.*<(.*)>/ REPLACE From: <${1}>
/^From:\s?(.*)(\s+\(.*)/ REPLACE From: <${1}>
endif
If its not a DKIM signed email, replace From addresses that match these formats:
From: Mr Fake <[email protected]>
From: [email protected] (Mr Fake)
I just run a quick test with postfix, header_checks runs quite early, so the
modification happens before all milters/scanners/spamassassin/etc. I don't know
if that is the right thing, maybe an alternative is to run it as
milter_header_checks, I'm not sure.
On Tue, 8 Dec 2020 11:28:46 -0500 Phil Pennock via mailop <[email protected]>
wrote:
> On 2020-12-08 at 16:13 +0200, Mary via mailop wrote:
> > So in postfix you'd do something like this? (under header_checks)
> >
> > /^From:.*<(.*)>/ REPLACE From: $1
> >
> > I wrote that in my email client, so I don't expect my regex to work. I
> > guess it would be fun to see how much damage I can do with something like
> > that...
>
> Don't forget the "obsolete" form:
>
> From: [email protected] (Foo Smith)
>
> (because the spammers won't forget)
> -Phil
> _______________________________________________
> mailop mailing list
> [email protected]
> https://list.mailop.org/listinfo/mailop
_______________________________________________
mailop mailing list
[email protected]
https://list.mailop.org/listinfo/mailop
