Sorry, I meant this doesn't work:
header BAD_FROM_PSFC From: =~ /^\S+\@psfc.mit.edu,/i
Without the ^ It does work:
header BAD_FROM_PSFC From: =~ /\S+\@psfc.mit.edu,/i
So I just tried:
header BAD_FROM_PSFC From: =~ /^\W*\S+\@psfc.mit.edu,/i
And that works. although I don't know why I need the \W*. But,
whatever! Never mind. - Mark
On 12/20/2018 12:30 PM, Mark London wrote:
Hi - What's the best rule to catch email with multiple addresses in the From:
line? I realize thatrfc2822allows it. But the only email we've ever received
with multiple addresses, were spam, and even GMAIL.COM doesn't allow it:
<<< 550-5.7.1 Messages with multiple addresses in From:
<<< 550 5.7.1 header are not accepted. e7si4119336qvp.159 - gsmtp
At the very least, I want to block emails that spoof my domain. I.e. I want to
block email that has @psfc.mit.edu followed by a comma. For example:
From:struth...@psfc.mit.edu,
"Lorraine M.<lstru...@slac.stanford.edu>"<xp...@clientes.xhost.cl>
I tried to have a rule like:
header BAD_FROM_PSFC From: =~ /\S+\@psfc.mit.edu,/i
This rule gets triggered when I run spamassasin manually on the email. But it
doesn't gets triggered on actual incoming email. I even tried:
header BAD_FROM_PSFC ALL =~ /From: \S+\@psfc.mit.edu,/i
It's still not triggered. Any ideas? Thanks. - Mark
