On Sat, Feb 21, 2004 at 08:25:12PM +0000, Duncan Hill wrote: > > > > whitelist_from_rcvd [EMAIL PROTECTED] ebay.com > > How far back in the headers does that check? I've been seeing spam where the > first hop is a faked received from valid_ebay_ip by the spammer's host...
SA assumes that hosts named in trusted_networks (i.e. those hosts which accept mail on your behalf) can be relied upon to report the correct incoming IP address, and checks that the last untrusted hop matches the third term in the rule. Doesn't matter if a spammer fakes it further down the Received lines, it's the one where they deliver it to your network that counts. Nick
