On Mon, 12 Aug 2013, Bowie Bailey wrote:
On 8/12/2013 2:48 PM, John Hardin wrote:
On Mon, 12 Aug 2013, Quanah Gibson-Mount wrote:
> --On Friday, August 09, 2013 12:42 AM +0200 Benny Pedersen wrote:
>
> >
> > body __BODY_FACEBOOK /Facebook/
> > meta __FORGED_SENDER (!SPF_PASS && !DKIM_VALID_AU)
> > meta FORGED_FACEBOOK_BODY (__BODY_FACEBOOK && __FORGED_SENDER)
> >
> > maybe it could be more specific, just not tested it, but why accept
> > forged ?
> Thanks, that is helpful. So I assume then I would do something like:
>
> score FORGED_FACEBOOK_BODY 3.0
>
> to give it a high SPAM score.
...so you want to punish any email that discusses Facebook and does not
pass SPF *AND* DKIM? Regardless of where the message is (or claims to be)
from?
Actually, __FORGED_SENDER only fires if the message fails *both* SPF and
DKIM.
(not A) and (not B) == not (A or B)
D'oh!
But this is still a check for message *discussing* Facebook and not messages
specifically *from* Facebook.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
It's easy to be noble with other people's money.
-- John McKay, _The Welfare State:
No Mercy for the Middle Class_
-----------------------------------------------------------------------
3 days until the 68th anniversary of the end of World War II
