Re: The "from" header looks like paypal but it is coming from somewhere else.

2017-02-12 Thread P.V.Anthony
On 11/02/2017 10:38, /dev/rob0 wrote: This appears to be from Mailchimp, so reporting it as abuse is likely to yield some satisfactory results. Thanks to everyone for the advice. P.V.Anthony smime.p7s Description: S/MIME Cryptographic Signature

Re: The "from" header looks like paypal but it is coming from somewhere else.

2017-02-10 Thread /dev/rob0
On Thu, Feb 09, 2017 at 06:16:36PM +0800, P.V.Anthony wrote: > Just got an scam email that looks like from paypal. > > It passed dkim and spf. > > dkim=pass (1024-bit key) header.d=service2.sdmone.email > header.i=sdmone@service2.sdmone.email header.b="adXLiw9w"; > dkim=pass (1024-bit

AW: The "from" header looks like paypal but it is coming from somewhere else.

2017-02-09 Thread Uwe Drießen
Im Auftrag von P.V.Anthony > Since the email contains the following. > > From: =?utf-8?Q?service=40paypaI=2Ecom=2Esg?= > > > What do you all think about that? > > P.V.Anthony > Perhaps if /^From:.*paypal.*/ if !/\<.+@(.\.)?paypal\.(de|com)\>$/

Re: The "from" header looks like paypal but it is coming from somewhere else. [signed]

2017-02-09 Thread Sebastian Nielsen
;*From: *Sebastian Nielsen >*Sent: *Thursday, February 9, 2017 2:24 AM >*To: *postfix-users@postfix.org >*Subject: *Re: The "from" header looks like paypal but it is coming >from >somewhere else. [signed] > >The problem here is that DKIM isn't aligned to paypal.com &g

Re: The "from" header looks like paypal but it is coming from somewhere else. [signed]

2017-02-09 Thread Dominic Raferd
-users@postfix.org *Subject: *Re: The "from" header looks like paypal but it is coming from somewhere else. [signed] The problem here is that DKIM isn't aligned to paypal.com Enforce strict DKIM alignment on sensitive domains like paypal I don't think this is a DKIM issue. A bespoke regex

Re: The "from" header looks like paypal but it is coming from somewhere else. [signed]

2017-02-09 Thread lists
ot; header looks like paypal but it is coming from somewhere else. [signed]The problem here is that DKIM isn't aligned to paypal.com Enforce strict DKIM alignment on sensitive domains like paypal

Re: The "from" header looks like paypal but it is coming from somewhere else. [signed]

2017-02-09 Thread Sebastian Nielsen
The problem here is that DKIM isn't aligned to paypal.com Enforce strict DKIM alignment on sensitive domains like paypal smime.p7s Description: S/MIME Cryptographic Signature