Re: SPF and blocking phishing attempts

2015-10-14 Thread Benny Pedersen
Dave Wreski skrev den 2015-10-15 00:11: Yes, I realize SPF is only concerned with the envelope-sender. I was thinking it would be possible to somehow correlate the SPF_PASS with a rule that analyzes the From: header and use that to compare? From: header is dkim, just know that some milters lik

Re: SPF and blocking phishing attempts

2015-10-14 Thread Reindl Harald
Am 14.10.2015 um 23:51 schrieb Alex: I have a few questions about SPF as it relates to spamassassin, and more specifically, as it relates to stopping incoming phishing attempts, and assumes we're using "-all". I'd like to make sure incoming mail that appears to be "From:" one of our internal u

Re: SPF and blocking phishing attempts

2015-10-14 Thread David B Funk
On Wed, 14 Oct 2015, Dave Wreski wrote: Hi, On 10/14/2015 06:08 PM, Dianne Skoll wrote: On Wed, 14 Oct 2015 17:51:23 -0400 Alex wrote: I'd like to make sure incoming mail that appears to be "From:" one of our internal users has indeed gone through one of the systems specified in the SPF rec

Re: SPF and blocking phishing attempts

2015-10-14 Thread Dave Wreski
Hi, On 10/14/2015 06:08 PM, Dianne Skoll wrote: On Wed, 14 Oct 2015 17:51:23 -0400 Alex wrote: I'd like to make sure incoming mail that appears to be "From:" one of our internal users has indeed gone through one of the systems specified in the SPF record, resulting in an SPF_PASS. Can't be

Re: SPF and blocking phishing attempts

2015-10-14 Thread Dianne Skoll
On Wed, 14 Oct 2015 17:51:23 -0400 Alex wrote: > I'd like to make sure incoming mail that appears to be "From:" one of > our internal users has indeed gone through one of the systems > specified in the SPF record, resulting in an SPF_PASS. Can't be done. SPF looks at the envelope sender (what e

SPF and blocking phishing attempts

2015-10-14 Thread Alex
Hi, I have a few questions about SPF as it relates to spamassassin, and more specifically, as it relates to stopping incoming phishing attempts, and assumes we're using "-all". I'd like to make sure incoming mail that appears to be "From:" one of our internal users has indeed gone through one of