On Tuesday 28 March 2017 13:58:43 Alex wrote: > I'd like to be able to use the fact that the To address is not the > same as the address shown in the Received header in a meta of some > kind. > > How frequent would you think that would appear in ham alone? It's the > basis for a number of phishing attacks here, so I'd like to see about > using it in some way. >
Checking that the envelope recipient address is in To or Cc works great on my mail and also for any public role addresses like sales or support, but probably not so much for general users. Any BCC will hit such a rule. And of course you have to exclude real mailing list mail. I guess the question would be how many legit bcc's do your users get from non- whitelisted senders?
