On 9/7/2010 12:50 PM, Martin Gregorie wrote: > On Tue, 2010-09-07 at 16:46 +0100, Mike Bro wrote: >> Hello, >> >> Enviroment: >> latest sendmail and latest spamassassin >> >> I am just trying to fight with spammer that used to send too many emails. >> The pattern I discovered is that during smtp communication with my >> incoming mail server in from field he puts something like: >> MAIL FROM: <"some rubbish words" <>> >> >> That results in my qf... file as line: >> S<"some rubbish words" <>> >> >> Any idea how I could write a rule in spamassassin to test this line? >> > I don't recognise "MAIL FROM:" as any sort of standard mail header. > Telling us some header is "something like" this is not useful > information either. > > If you want help, show us *exactly* what the header looks like. Better > yet, upload the entire mail message to Pastebin or an equivalent and > post the URL here so we can see the entire spam.
"MAIL FROM:" is the envelope sender from the smtp dialog. This information is not available to SA unless your MTA writes it into the headers. Show us a sample message (headers and all) as Martin requested and we may be able to help. -- Bowie
