On 12/23/2019 10:42 PM, Carl Byington via mailop wrote: > The spam was sent with a From: header of @email.chase.com. > _dmarc.email.chase.com. has a txt record with p=reject, so it was > rejected here. Sendgrid - you should be able to check that at your end, > and just not send anything that violates the dmarc restriction published > by the ostensible sender.
Carl, We've been seeing the same over the past few weeks as a growing threat. They are abusing sendgrid and the SPF records and the envelope from to mimic some big players. If you use Apache SpamAssassin, I'm working on rules with KAM.cf to combat this. Email me off list and I'll take a look at your spamples. If there is a sendgrid rep on the list, please contact me as well. Regards, KAM _______________________________________________ mailop mailing list mailop@mailop.org https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
