Re: How to block email with multiple addresses in From: IGNORE ME.

[Mark London <mr...@psfc.mit.edu>]

Sorry, I meant this doesn't work:

header BAD_FROM_PSFC                    From: =~ /^\S+\@psfc.mit.edu,/i

Without the ^ It does work:

header BAD_FROM_PSFC                    From: =~ /\S+\@psfc.mit.edu,/i

So I just tried:

header BAD_FROM_PSFC                    From: =~ /^\W*\S+\@psfc.mit.edu,/i

And that works.  although I don't know why I need the \W*.   But, 
whatever!   Never mind. - Mark

On 12/20/2018 12:30 PM, Mark London wrote:
> Hi - What's the best rule to catch email with multiple addresses in the From: line?  I realize thatrfc2822allows it.  But the only email we've ever received with multiple addresses, were spam, and even GMAIL.COM doesn't allow it:
>
> <<< 550-5.7.1 Messages with multiple addresses in From:
> <<< 550 5.7.1 header are not accepted. e7si4119336qvp.159 - gsmtp
>
> At the very least, I want to block emails that spoof my domain.  I.e. I want to block email that has @psfc.mit.edu followed by a comma.  For example:
>
> From:Struthers@psfc.mit.edu,
>          "Lorraine M.<ls...@clientes.xhost.cl>
>
> I tried to have a rule like:
>
> header BAD_FROM_PSFC                    From: =~ /\S+\@psfc.mit.edu,/i
>
> This rule gets triggered when I run spamassasin manually on the email.   But it doesn't gets triggered on actual incoming email.   I even tried:
>
> header BAD_FROM_PSFC                    ALL =~ /From: \S+\@psfc.mit.edu,/i
>
> It's still not triggered.  Any ideas?  Thanks. - Mark
>   
>