[Assp-test] Flood of ATT Fake Bills

I just started to get a flood of ATT Wireless bill emails this morning and see that there is no SPF record for their domain. Any suggestions on how to block this without blocking the real emails, which I have validated also come from the same source email address? Headers for the bad email are

Re: [Assp-test] Flood of ATT Fake Bills

Remove ica...@amcustomercare.att-mail.com from whitelist Add att.com to whiteorg.txt (whiteSenderBase) -- Symantec Endpoint Protection 12 positioned as A LEADER in The Forrester Wave(TM): Endpoint Security, Q1 2013

Re: [Assp-test] Flood of ATT Fake Bills

Fritz, Should I add att.com or att-mail.com or amcustomercare.att-mail.com to the whiteSenderBase? ATT.com doesn't seem related to the below email address is why I ask. Rusty Nejdl On 2013-03-08 13:02, Fritz Borgstedt wrote: Remove ica...@amcustomercare.att-mail.com from whitelist Add

Re: [Assp-test] Flood of ATT Fake Bills

rne...@ringofsaturn.com schreibt: Should I add att.com or att-mail.com or amcustomercare.att-mail.com to the whiteSenderBase? ATT.com doesn't seem related to the below email address is why I ask. whiteSenderBase is using the sending IP to check organization/domain for whitelisted entries. The