Penalizing mail with multiple Subject or From header fields?

[Mark Martinec <Ma...@ijs.si>]

Is it possible to add some score points to mail which has multiple
Subject header fields and/or multiple From header fields?

I guess not, but it is worth asking nevertheless. I have some
fine spam specimens with two Subject lines (with different texts)
and two From lines (again with different texts). It is amazing
how weirdly some mail readers react to such mail (like toggling
contents of a line in a mail list when stepping to such mail).
I don't know if it was intentional or not, but it appears
to have a potential for tricking users or filters.

(according to RFC2822 there should be exactly one From field
(with possibly multiple addresses of mail authors),
and zero or one Subject field)


  Mark

Re: Penalizing mail with multiple Subject or From header fields?

[Noel Jones <no...@gmail.com>]

On 5/31/06, Benny Pedersen <me...@junc.org> wrote:
>
> but should this not be more in postfix header check ?
>
> does someone know if there is a set of rfc checks for postfix exists anywhere ?
>

Not possible with postfix header_checks.  Header_checks cannot test
for the absence of a  header, nor test for multiple occurrences of
some particular header.

-- 
Noel Jones

Re: Penalizing mail with multiple Subject or From header fields?

[Benny Pedersen <me...@junc.org>]

>> header L_DOUBLE_SUBJECT ALL =~ /^Subject:.*^Subject:/smi
>> header L_DOUBLE_FROM    ALL =~ /^From:.*^From:/smi
>
> Doing some more research on my suggestion
> and evaluating results for the last three days, here is a proposal for new rule:
>
> http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4927
>
> Take it or leave it  :)

i take it :-)

but should this not be more in postfix header check ?

does someone know if there is a set of rfc checks for postfix exists anywhere ?

anyway thanks for the rule that works

Re: Penalizing mail with multiple Subject or From header fields?

[Mark Martinec <Ma...@ijs.si>]

> header L_DOUBLE_SUBJECT ALL =~ /^Subject:.*^Subject:/smi
> header L_DOUBLE_FROM    ALL =~ /^From:.*^From:/smi

Doing some more research on my suggestion
and evaluating results for the last three days,
here is a proposal for new rule:

  http://issues.apache.org/SpamAssassin/show_bug.cgi?id=4927

Take it or leave it  :)

  Mark

Re: Penalizing mail with multiple Subject or From header fields?

[Mark Martinec <Ma...@ijs.si>]

> header TWO_SUBJS      ALL =~ /(?:^|\n)Subject:.*\nSubject:/s
> header DOUBLE_SUBJECT ALL =~ /\nSubject: *\nSubject:.\s+\S/m

So this is what it boils down to, tested:

header L_DOUBLE_SUBJECT ALL =~ /^Subject:.*^Subject:/smi
score  L_DOUBLE_SUBJECT 0.9
header L_DOUBLE_FROM    ALL =~ /^From:.*^From:/smi
score  L_DOUBLE_FROM    0.9

Thanks to both of you, Justin and Loren.

  Mark

Re: Penalizing mail with multiple Subject or From header fields?

[John Rudd <jr...@ucsc.edu>]

On May 26, 2006, at 10:37 AM, Loren Wilton wrote:

>> Is it possible to add some score points to mail which has multiple
>> Subject header fields and/or multiple From header fields?
>
> Sure.  Ugly, but certainly possible.  Something like
>
> header DOUBLE_SUBJECT ALL =~ /\nSubject: *\nSubject:.\s+\S/m
>


Shouldn't this be:

header DOUBLE_SUBJECT ALL =~ /\nSubject: .*\nSubject:\s+\S/m

Re: Penalizing mail with multiple Subject or From header fields?

[Loren Wilton <lw...@earthlink.net>]

> Is it possible to add some score points to mail which has multiple
> Subject header fields and/or multiple From header fields?

Sure.  Ugly, but certainly possible.  Something like

header DOUBLE_SUBJECT ALL =~ /\nSubject: *\nSubject:.\s+\S/m

        Loren