The following rules look for a From label which looks to have an email address 
looks for this type of spoofed address

The following would be valid, for example:

From: "p...@domain.com"<mailto:p...@domain.com> 
<p...@domain.com><mailto:p...@domain.com>

http://ruleqa.spamassassin.org/20161017-r1765221-n/T_PDS_FROM_2_EMAILS/detail

http://ruleqa.spamassassin.org/20161017-r1765221-n/T_FROM_2_EMAILS/detail - 
similar to above with less metas

They both seem to hit more ham than spam on the Corpus


Paul

On 18/10/16 07:27, Ruga wrote:
Yes, you can prefix a quoted string to the actual address. No, the quoted 
string is not part of the address.

There are two approaches here: one is to defend the spammer's abuse of the 
standard (intended to trick the average Joe into believing they have received 
mail from someone else), and the other is to read the standard


On Tue, Oct 18, 2016 at 4:02 AM, Dianne Skoll 
<'d...@roaringpenguin.com'><mailto:'d...@roaringpenguin.com'> wrote:
On Mon, 17 Oct 2016 19:11:29 -0400
Ruga <r...@protonmail.com><mailto:r...@protonmail.com> wrote:

rfc 822 (the actual standard):

Which as I mentioned is obsolete, but I'll play with you...

authentic = "From" ":" mailbox ; Single author / ...
mailbox = addr-spec ; simple address / phrase route-addr
addr-spec = local-part "@" domain

And you left out the BNF of "phrase", didn't you? Tsk tsk!

You can't pick and choose pieces of RFCs, you know. They come as a package
deal.

TL;DR, the header:

From: "Dianne Skoll <d...@roaringpenguin.com><mailto:d...@roaringpenguin.com>" 
<some...@spammer.org><mailto:some...@spammer.org>

is absolutely compliant with RFC-822 and its successors, RFC-2822 and
RFC-5322.

Regards,

Dianne.

--
Paul Stead
Systems Engineer
Zen Internet

Reply via email to