Mark Martinec wrote:
OK, this I did not know. I thought it was restricted to one From: with a Sender: alternative. If that was the case, a Reply-To (which is singular) should be supplied. Or something like that...Tom, (and Hamish),(thanks for your private mail, sounde very useful, I'll reply to it separately) (btw, did you know that RFC2822 explicitly states that it is valid to have more than one address in the From field! E.g. a secretary (Sender) mailing a scientific paper of two authors (From) to the publisher)
In any event, the entire email should fall into a single recipient on a Reply process. I think. It's that single recipient that would have value to me.
Again, I didn't know this either. However, the Debian-user list is one such example of problem Senders. We are regularly hit with spam that comes through the debian-user address. The last thing I can afford to do is backlist the entire debian-user email list based on one high scoring spam. Because of this, I've settled on using the Header From: address.amavisd-new adds its own (manual) white/blackisting, which is based on envelope sender address. I consider this more useful and predictable, especially for whitelisting mailing lists, where you often want to whitelist the mailing list manager address, not all hundreds of correspondents, or rely on some parsing guesswork to obtain list name. All three variants (hash, ACL, regexp) lookups are available.
Functionally, this seems effective in finding and blocking spam.
I guess I haven't done a real good job in reading the RFC2822, but most of what I've learned about spam in particular has been based on what I've seen.
Finding differences between the Header and Envelope From addresses alone seems to account for a huge percentage of spam without any additional checking. But there's a lot of exceptions that make it hard to work around.
I'll take a look again at the amavisd-new Envelope whitelisting...
--
You may be infinitely smaller than some things, but you're infinitely
larger than others.
-------------------------------------------------------
This sf.net email is sponsored by:ThinkGeek
Welcome to geek heaven.
http://thinkgeek.com/sf
_______________________________________________
Spamassassin-talk mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
