Re: Matching To and Received addresses

2017-03-29 Thread John Hardin
On Wed, 29 Mar 2017, Alex wrote: Would I need to create one ALL rule for each user involved? Probably not, the username part could be something like (?:user1|user2|user3)@example\.com I don't understand how ALL would help here. You can't incorporate matches in one rule into a different r

Re: Matching To and Received addresses

2017-03-29 Thread John Hardin
On Wed, 29 Mar 2017, Matus UHLAR - fantomas wrote: On Tuesday 28 March 2017 13:58:43 Alex wrote: > I'd like to be able to use the fact that the To address is not the > same as the address shown in the Received header in a meta of some > kind. > > How frequent would you think that would appe

Re: Matching To and Received addresses

2017-03-29 Thread Alex
Hi, On Tue, Mar 28, 2017 at 2:27 PM, John Hardin wrote: > On Tue, 28 Mar 2017, Dominic Benson wrote: > >>> On 28 Mar 2017, at 19:04, Markus wrote: >>> >>> So you can't compare the "for " with "To: >>> doro...@example.com". > > You can do that with a Header ALL rule; it will work more reliably as

Re: Matching To and Received addresses

2017-03-29 Thread Markus Clardy
On 03/28/2017 08:09 PM, Dianne Skoll wrote: > The "for..." clause is optional and a lot of MTAs don't add it. > Almost all MTAs will refuse to add it if it's for more than > one local recipient. True, but that is what OP is asking about comparing to, which is why I had mentioned it.

Re: Matching To and Received addresses

2017-03-29 Thread Matus UHLAR - fantomas
On Tuesday 28 March 2017 13:58:43 Alex wrote: I'd like to be able to use the fact that the To address is not the same as the address shown in the Received header in a meta of some kind. How frequent would you think that would appear in ham alone? It's the basis for a number of phishing attacks h

Re: Matching To and Received addresses

2017-03-28 Thread Dianne Skoll
On Tue, 28 Mar 2017 19:49:10 +0100 Markus wrote: > Honestly didn't even think of mailing lists such as this, nor BCC > (don't deal with BCC emails very much to be honest). > Though, would you not be able to test against the bottom most > Received header compared to the To: header? The "for..."

Re: Matching To and Received addresses

2017-03-28 Thread Markus
Honestly didn't even think of mailing lists such as this, nor BCC (don't deal with BCC emails very much to be honest). Though, would you not be able to test against the bottom most Received header compared to the To: header? Received: from localhost (jhardin@localhost) by athena.impse

Re: Matching To and Received addresses

2017-03-28 Thread John Hardin
On Tue, 28 Mar 2017, Dominic Benson wrote: On 28 Mar 2017, at 19:04, Markus wrote: So you can't compare the "for " with "To: doro...@example.com". You can do that with a Header ALL rule; it will work more reliably as a local rule because you know how your local MTA is annotating the envelo

Re: Matching To and Received addresses

2017-03-28 Thread Alan Hodgson
On Tuesday 28 March 2017 13:58:43 Alex wrote: > I'd like to be able to use the fact that the To address is not the > same as the address shown in the Received header in a meta of some > kind. > > How frequent would you think that would appear in ham alone? It's the > basis for a number of phishing

Re: Matching To and Received addresses

2017-03-28 Thread Dianne Skoll
On Tue, 28 Mar 2017 19:04:44 +0100 Markus wrote: > How likely is it to be in legitimate mail? Highly unlikely (if ever), > so you'd be pretty safe outright rejecting mail that behaves this > way, to be honest. You'd reject every single message in this mailing list if you did that. Regards, Dia

Re: Matching To and Received addresses

2017-03-28 Thread Dominic Benson
> On 28 Mar 2017, at 19:04, Markus wrote: > > Hello Alex, > > To my knowledge, you can't compare equality without a SpamAssassin plugin. > > So you can't compare the "for " with "To: > doro...@example.com". > > With a plugin, you could definitely do that, but that would cause a bit more > o

Re: Matching To and Received addresses

2017-03-28 Thread Markus
Hello Alex, To my knowledge, you can't compare equality without a SpamAssassin plugin. So you can't compare the "for " with "To: doro...@example.com". With a plugin, you could definitely do that, but that would cause a bit more overhead (and some perl development). How likely is it to be

Matching To and Received addresses

2017-03-28 Thread Alex
Hi, Is there an existing rule that detects when the To address differs from the address to which the email is to be delivered? We've received a number of messages directed at executives based on the recipient address and Received address, both of which are within the same domain but to different