On Sat, 29 Aug 2026, Kenneth Porter wrote:
Thanks, John. I was a little reluctant to post it to Bugzilla (where I
already have an account) as it looked a bit tricky to redact and it's got
stuff in the headers I'd rather not reveal. (For example, my public email
address goes through some changes (virtusertable and aliases) before
delivering to a local username I don't want to publicly reveal.)
I'll send the two samples privately and let you spot the missing exemption.
Ideally the company can fix their template to avoid the rule. I do see that
it's going through SendGrid from the Return-Path bounce address but the body
doesn't show any evidence of tracking links.
Not a problem.
The message content looks _exactly_ like the sort of thing a phisher would
send. The only real "this is legit" tell from the content is that there is
no third-party link (URL or email address) to a collector, but a naïve
check for third-party domains would trip over your email address that's
included in the body, and over an image that they are retrieving from
Okta.
Based on those messages this _should_ help, assuming it's passing DKIM
checks locally:
whitelist_from_dkim *@americocustomer.com americocustomer.com
Note that this is a general best practice: whitelist_auth domains that you
have a business relationship with.
A stronger gate is to blacklist_from AND whitelist_auth - I do this sort
of thing:
whitelist_auth *@wellsfargo.com
blacklist_from *@wellsfargo.com
whitelist_auth *@*.wellsfargo.com
blacklist_from *@*.wellsfargo.com
Or if you don't want to trust SPF:
whitelist_from_dkim *@wellsfargo.com wellsfargo.com
blacklist_from *@wellsfargo.com
whitelist_from_dkim *@*.wellsfargo.com wellsfargo.com
blacklist_from *@*.wellsfargo.com
I note that Bugzilla does have "Rules" as a category and there was even a
URI_PHISH bug already registered (and marked wont-fix).
Yeah, it's not a hard rule, it's generally just "Can you instead take this
to the Users list where we can discuss it publicly?".
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
[email protected] pgpk -a [email protected]
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
The United States has become a place where entertainers and
professional athletes are mistaken for people of importance.
-- Maureen Johnson Smith Long
-----------------------------------------------------------------------
684 days since SpaceX caught the SuperHeavy booster on the first try
