On Sat, 8 May 2021 17:04:00 -0400 Alex wrote: > Hi, > I'm trying to understand the FROMNAME rules and a potential conflict > with PDS_FROM_2_EMAILS. > > I understand FROMNAME_SPOOF is designed to catch differences like: > > From: "no-re...@amazon.com" <j...@example.com> > > but what other spoofs is the FromName.pm plugin designed to catch?
That's pretty much it. The plugin never really needed to exist. > I've also noticed that the PDS_FROM_2_EMAILS meta and > PDS_FROMNAME_SPOOFED_EMAIL hits on many similar components that I > wondered if there's overlap Duplication is quite common. PDS_FROMNAME_SPOOFED_EMAIL doesn't appear to exist anymore. PDS_FROM_2_EMAILS is similar to what the plugin does, but it contains exclusions that, amongst other things, reduce matches on mail from actual mail servers. It include "&& !__DKIM_EXISTS", so it's useless in the case where <j...@example.com> is from an account or mail-system abused to gain a DMARC pass.
