On Thu, 2019-11-21 at 13:24 -0500, Dave Goodrich wrote: > > Any thoughts on that or has anyone done something similar? > I have a similar rule that spotsfires on From: headers with @ in the name and a space in the address. I wrote it to spot rather obvious false senders, but something like the following should work for you, obviously with a suitable rule name and the correct display name and address used by your mayor:
describe SPOOFED_MAYOR Check for spoofed mail from the Mayor header __SM1 From:name /display name/ header __SM2 From:addr /email address/ meta SPOOFED_MAYOR (__VM1 && ! __VM2) score SPOOFED_MAYOR 5.0 Martin
