This goes along the custom rule to match a forged Received line claiming to be 
your own mail server. The new addition to that is forging of 
X-Originating-IP.

eg:
header   LOCAL_MY_IP     Received =~ /\bfrom 216\.98\.192\.5\b/i
describe LOCAL_MY_IP     Why would I get mail from my own server?
score    LOCAL_MY_IP     1.000

header   LOCAL_X_ORIGIN  X-Originating-IP =~ /\b216\.98\.192\.5\b/
describe LOCAL_X_ORIGIN  Mail from a local server without shells.
score    LOCAL_X_ORIGIN  1.000

meta     LOCAL_IM_YOU    LOCAL_MY_IP && LOCAL_X_ORIGIN
describe LOCAL_IM_YOU    Spammer trying to claim to be my own server.
score    LOCAL_IM_YOU    1.000

Reply via email to