The following rules look for a From label which looks to have an email address
looks for this type of spoofed address
The following would be valid, for example:
similar to above with less metas
They both seem to hit more ham than spam on the Corpus
On 18/10/16 07:27, Ruga wrote:
Yes, you can prefix a quoted string to the actual address. No, the quoted
string is not part of the address.
There are two approaches here: one is to defend the spammer's abuse of the
standard (intended to trick the average Joe into believing they have received
mail from someone else), and the other is to read the standard
On Tue, Oct 18, 2016 at 4:02 AM, Dianne Skoll
On Mon, 17 Oct 2016 19:11:29 -0400
Ruga <r...@protonmail.com><mailto:r...@protonmail.com> wrote:
rfc 822 (the actual standard):
Which as I mentioned is obsolete, but I'll play with you...
authentic = "From" ":" mailbox ; Single author / ...
mailbox = addr-spec ; simple address / phrase route-addr
addr-spec = local-part "@" domain
And you left out the BNF of "phrase", didn't you? Tsk tsk!
You can't pick and choose pieces of RFCs, you know. They come as a package
TL;DR, the header:
From: "Dianne Skoll <d...@roaringpenguin.com><mailto:d...@roaringpenguin.com>"
is absolutely compliant with RFC-822 and its successors, RFC-2822 and