PowerMail 5.0.1 and SpamSieve are doing a good job of catching spam, but
I have noticed a problem: some of the spam that I receive doesn't get
evaluated, because the spammer uses my email address in the "From:" and
"Reply-To:" fields.

E.g.

Reply-To: "Beryl Slaughter" <[EMAIL PROTECTED]>
From: "Beryl Slaughter" <[EMAIL PROTECTED]>
To: "Jeremy" <[EMAIL PROTECTED]>

This evades PowerMail's evaluate filter because it falsifies the
conditions "From, Sender, or Reply-To is not in address book" and "From,
Sender, or Reply-To is not in previous recipients" (my email address is
in my address book and I sometimes send emails to myself).

I think that my email address should be excluded from these conditions,
because it is a common trick for spammers to use a recipient's email
address in this way in order to evade spam filters. SpamSieve has a
preference for excluding my address, but it makes no difference in this
case, because SpamSieve never gets to look at these messages.

As a workaround, I have set up an additional filter which evaluates the
spam rating if "From, Sender, or Reply-To contains [EMAIL PROTECTED]"
and "From, Sender, or Reply-To does not use your real name". When I did
this, PowerMail warned me that I now have two evaluate spam filters, but
I don't think this matters since the filters catch different emails.
Maybe PowerMail should provide a "has not been evaluated" condition to
prevent emails from being evaluated twice, or have an internal check
which will prevent this from happening, i.e. only evaluate spam if it has
not previously been evaluated (maybe it does this already?)

Jeremy


Reply via email to