Re: SA rule that does verify sender

[Justin Mason <jm...@jmason.org>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Daniel Quinlan writes:
>Ari Jort <ar...@amnh.org> writes:
>
>> I've implemented a verify_sender routine as inspired by 
>> the postfix address verification, noted below.  Patch
>> is attached.
>
>Interesting.
> 
>> I added a subroutine in EvalTests.pm called verify_sender()
>> that will verify a given address with an appropriate mx.
>> It needs a mechanism to get the envelope-from for this
>> to be effective.  This implementation relies on the header
>> Return-Path: which postfix adds to messages.
>
>We really should have a standard method for finding the envelope-from.
>
>Right now, have have the envfrom field in the Received headers data
>structure.  If it doesn't find the right headers or look at things like
>Return-Path There's also all_to_addrs() which obviously isn't right, but
>is related.

We do -- the pseudo-header "EnvelopeFrom" will do this.

>The other issue is that this could possibly be used as an address
>verification technique by spammers.
>
>You should also make this a plugin for 3.0.

yep -- and link to it from the CustomPlugins page on the wiki...

- --j.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Exmh CVS

iD8DBQFAYN4AQTcbUG5Y7woRAoCCAJ41zG5HdT463sT7tzfRNx+fz7maaACghowm
9u4Q9OTRikeetRpIDMkG/pw=
=FvtD
-----END PGP SIGNATURE-----

Re: SA rule that does verify sender

[Daniel Quinlan <qu...@pathname.com>]

Justin Mason <jm...@jmason.org> writes:

> We do -- the pseudo-header "EnvelopeFrom" will do this.

Ah, thanks -- I need to get out of the habit of looking at the installed
(2.63) Conf.pm documentation, I had missed that.  :-)

Daniel

-- 
Daniel Quinlan                     anti-spam (SpamAssassin), Linux,
http://www.pathname.com/~quinlan/    and open source consulting