On Sat, 17 Nov 2018 13:22:55 +0000 David Jones wrote: > 2. Seems like there should be easy rules to detect more than one pair > of angle brackets and more than on at sign to add points to > non-standard display names.
The reason I asked about the precise form is that it's not simply a bracketed address in the display name, the brackets need quoting so it's not syntactically correct either. The rule I suggested: header FROM_NO_COMMA From =~ />\s*<[^"]*$/ targets that specific case. The NO_COMMA part is because From: User <u...@company.com>, <arte.fin...@creativegroup.com.ec> would be unusual, but it's legitimate and no use to a spammer because it can fail DMARC on either domain.
