How many Froms?

2010-04-28 Thread Charles Gregory
Hiyo! Occasionally I see an e-mail with multiple addresses on the 'From:' header. (not the envelope) Can anyone think of legitimate uses for multiple From: addresses? Or could I just use a rule like: header From =~ /\...@.*\@/ - C

Re: How many Froms?

2010-04-28 Thread Martin Gregorie
On Wed, 2010-04-28 at 12:41 -0400, Charles Gregory wrote: Occasionally I see an e-mail with multiple addresses on the 'From:' header. (not the envelope) Do these messages also contain a 'Sender:' header? According to RFC 822 they should do so. Can anyone think of legitimate uses for

Re: How many Froms?

2010-04-28 Thread Frank Heydlauf
Hi, On Wed, Apr 28, 2010 at 08:05:27PM +0100, Martin Gregorie wrote: Having said that, I can't remember seeing multiple addresses on a From: header or a Sender: header. I have plenty of them in my mailfolder - but not formated in the way you thought about, regarding your cite of RFC822. On

Re: How many Froms?

2010-04-28 Thread David B Funk
On Wed, 28 Apr 2010, Frank Heydlauf wrote: Hi, On Wed, Apr 28, 2010 at 08:05:27PM +0100, Martin Gregorie wrote: [snip..] Or could I just use a rule like: header From =~ /\...@.*\@/ This regex matches i.e. From: u...@example.com u...@example.com which is a common auto expansion of

Re: [sa] Re: How many Froms?

2010-04-28 Thread Charles Gregory
On Wed, 28 Apr 2010, David B Funk wrote: There's an easy fix for that FP, just use the 'From:addr =~ ' varient of the header rule. That ignores the comment part of the 'From:' address and only examines the stuff inside the 'b...@blah.blah' part. Avoid FP, yes, but also avoid the live header

Re: How many Froms?

2010-04-28 Thread Bowie Bailey
David B Funk wrote: On Wed, 28 Apr 2010, Frank Heydlauf wrote: Hi, On Wed, Apr 28, 2010 at 08:05:27PM +0100, Martin Gregorie wrote: [snip..] Or could I just use a rule like: header From =~ /\...@.*\@/ This regex matches i.e. From: u...@example.com

[Copfilter] Copy of quarantined email - *** SPAM *** [8.9/7.0] Re: How many Froms?

2010-04-28 Thread babedh-d...@biggdog.biz
On Wed, 28 Apr 2010, Frank Heydlauf wrote: Hi, On Wed, Apr 28, 2010 at 08:05:27PM +0100, Martin Gregorie wrote: [snip..] Or could I just use a rule like: header From =~ /\...@.*\@/ This regex matches i.e. From: u...@example.com u...@example.com which is a common auto expansion of