> -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > Hello Mark, Michal, > > Friday, August 1, 2003, 2:35:25 PM, Mark (M) responded to Michal (MG) > with: > > M> ----- Original Message ----- > M> From: "Michal Gubik" <[EMAIL PROTECTED]> > M> To: <[EMAIL PROTECTED]> > M> Sent: Friday, August 01, 2003 9:06 PM > M> Subject: [SAtalk] how to stop mails with from=<> > > MG>> hi, I just wanna ask what rule should I aply to stop mails that > MG>> have in header from=<> . > > M> That is not a good idea. :) Read with me from RFC 1123, section 5.2.9: > M> 5.2.9 Command Syntax: RFC-821 Section 4.1.2 > M> The syntax shown in RFC-821 for the MAIL FROM: command omits > M> the case of an empty path: "MAIL FROM: <>" (see RFC-821 Page > M> 15). An empty reverse path MUST be supported. > > 1) I've checked my corpus, 3+ months of email, and I don't find any "<>" > in any From header. Do I misunderstand the situation?
Possibly. Your MTA automatically replaces the empty envelope address with MAILER-DAEMON. So any message with no From address at all (header or envelope) will appear to have come from MAILER-DAEMON. Quite a number of viruses do this... > 2) I don't believe in allowing SA to *stop* email, but I do believe in > allowing it to score and flag a wide variety of emails. A human can then > look at the email and decide what to do with it. Sure, but where is the correlation between an empty envelope-from and Spam ? As far as I can see, there isn't one. I've never come across a single piece of spam with no envelope from address, on the other hand it is normal for mailer daemon messages to be like this, so if anything there is a reverse correlation...but IMHO you don't want to go adding negative scores as they're so easily abused... Regards, Simon ------------------------------------------------------- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01 _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
