I'm not seeing both a "From" and a "Mail from" listed in the headers that come back from Declude.
So, it must be in some detail that not in %headers%.
I take it that Declude will send it to the "Mail from". Looks like I'll be testing with Swen Not forging.
You'll see the return address in the X-Declude-Sender: header. That's the only one that Declude Virus will use (for notifications, for example), and is not forged. As others have pointed out, the From: header may be forged (but Declude Virus does not use that header).
-Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000.
Declude Virus: Catches known viruses and is the leader in mailserver vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.Virus mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.Virus". The archives can be found at http://www.mail-archive.com.
