On 4-10-2019 1:12, Philip wrote:
Morning List,
Lately I'm getting a bunch of emails that are showing up with two
email addresses in the From: field.
From: "Persons Name <lo...@address.nz>" <s...@address.com>
When you look in your mail client (Outlook, Thunderbird) it's showing
only "Persons Name <lo...@address.nz>"
Is there a way I can mark From: that has 2 email addresses in it as
spam? Pro's Cons?
Phil
header FR_D_AT From =~ /\S+\@[\w\-\.]+.*\S+\@[\w\-\.]+/
describe FR_D_AT From has double email address?
score FR_D_AT 0.1
header FR_NA_SAME From =~ /(\S+\@[\w\-\.]+).*\1/
describe FR_NA_SAME From name and address is the same email
address.
tflags FR_NA_SAME nice
score FR_NA_SAME -0.1
meta SPOOF_EMAIL (FR_D_AT && ! FR_NA_SAME)
describe SPOOF_EMAIL From name and address have different email
address!
score SPOOF_EMAIL 2.5
--
bOnK
