On 23.06.22 15:56, Eduardo Maia wrote:
I'm trying to block the emails with fake FROM like:

From: "Nick Blue <n...@domain.pt>" <yk...@omega-eng.co.jp>

I have installed spamassassin  v3.4.6 and after I enabled the FromNameSpoof plugin.

I have checked FromNameSpoof plugin from SA 3.4.6 and it does not detect all mail with this kind of From:

out of 59 examples I got onto one server, 20 were detected, 39 undetected.

SA 4.0 (beta) catched all of them

I added the following lines on the files:

1- /etc/spamassassin/v342.pre :
loadplugin Mail::SpamAssassin::Plugin::FromNameSpoof

2 - /etc/spamassassin/local.cf
header LOCAL_FROMNAME_SPOOF eval:check_fromname_spoof()
score LOCAL_FROMNAME_SPOOF 5.0

My question is about how to configure this plugin and also which score i should give on the new rules ?

you have just described how you configured it.
the next question is how do you block them.


--
Matus UHLAR - fantomas, uh...@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
I don't have lysdexia. The Dog wouldn't allow that.

Reply via email to