Re: Trying to catch spoofed ToCc

[ha...@t-online.de]

Hi,

I am doing exactly that for my personal mailbox, and it took me a few months to define all
 my exceptions (mostly mailing list and forum related).
Are you sure you want to do this for hundreds of domains

Wolfgang Hamann

>> This is a multi-part message in MIME format.
>> 
>> ------_=_NextPart_001_01C71A54.2968304F
>> Content-Type: text/plain;
>> 	charset="us-ascii"
>> Content-Transfer-Encoding: quoted-printable
>> 
>> 
>> > In my mail setup, it is gospel that (ignoring BCC and mailing lists)
>> > the full email address in the Delivered-To will match an email address
>> > in the ToCc. =20
>> > Example below.
>> >=20
>> > Return-Path: <so...@somewhere.com>
>> > Delivered-To: jason@domain.ext
>> > Received: from mx01.domain.ext (unknown [172.16.0.149])
>> >         by localdelivery01 (Postfix) with ESMTP id EB9CA921E8C57
>> >         for <ja...@domain.ext>; Mon, 27 Nov 2006 19:36:46 -0500 (EST)
>> > From: <so...@somewhere.com>
>> > To: Jason <ja...@domain.ext>
>> > Cc: Jason <bl...@domain.ext>
>> > Subject: Testing
>> >=20
>> > I have created a matching rule to statically qualify the validity of a
>> > domain (below).
>> > #---------------------------------------------------------------------
>> > -----------------------------------
>> > header  __HEAD_01_01   Delivered-To =3D~  /\@domain\.ext/i
>> > header  __HEAD_01_02   ToCc !~  /\@domain\.ext/i
>> > #---------------------------------------------------------------------
>> > -----------------------------------
>> > meta    HEAD_01        (__HEAD_01_01 && __HEAD_01_02)
>> > score   HEAD_01        5.0
>> > #---------------------------------------------------------------------
>> > -----------------------------------
>> >=20
>> > I host hundreds of domains, so I cannot create static rules for each.
>> > My goal is to have a rule, much like the one above, but will qualify
>> > the entire email address from the Delivered-To to the ToCc.  No match
>> > equals a score.
>> >=20
>> > Any insight would be much appreciated.
>> >=20
>> >=20
>> > Thank you,
>> > Jason
>> >=20