Hi - What's the best rule to catch email with multiple addresses in the From:
line? I realize thatrfc2822allows it. But the only email we've ever received
with multiple addresses, were spam, and even GMAIL.COM doesn't allow it:
<<< 550-5.7.1 Messages with multiple addresses in From:
<<< 550 5.7.1 header are not accepted. e7si4119336qvp.159 - gsmtp
At the very least, I want to block emails that spoof my domain. I.e. I want to
block email that has @psfc.mit.edu followed by a comma. For example:
From: struth...@psfc.mit.edu,
"Lorraine M. <lstru...@slac.stanford.edu>" <xp...@clientes.xhost.cl>
I tried to have a rule like:
header BAD_FROM_PSFC From: =~ /\S+\@psfc.mit.edu,/i
This rule gets triggered when I run spamassasin manually on the email. But it
doesn't gets triggered on actual incoming email. I even tried:
header BAD_FROM_PSFC ALL =~ /From: \S+\@psfc.mit.edu,/i
It's still not triggered. Any ideas? Thanks. - Mark
