-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Hello Mark, Michal,
Friday, August 1, 2003, 2:35:25 PM, Mark (M) responded to Michal (MG) with: M> ----- Original Message ----- M> From: "Michal Gubik" <[EMAIL PROTECTED]> M> To: <[EMAIL PROTECTED]> M> Sent: Friday, August 01, 2003 9:06 PM M> Subject: [SAtalk] how to stop mails with from=<> MG>> hi, I just wanna ask what rule should I aply to stop mails that MG>> have in header from=<> . M> That is not a good idea. :) Read with me from RFC 1123, section 5.2.9: M> 5.2.9 Command Syntax: RFC-821 Section 4.1.2 M> The syntax shown in RFC-821 for the MAIL FROM: command omits M> the case of an empty path: "MAIL FROM: <>" (see RFC-821 Page M> 15). An empty reverse path MUST be supported. 1) I've checked my corpus, 3+ months of email, and I don't find any "<>" in any From header. Do I misunderstand the situation? 2) I don't believe in allowing SA to *stop* email, but I do believe in allowing it to score and flag a wide variety of emails. A human can then look at the email and decide what to do with it. 3) I've been using this rule with good results: header L_hr_NOREPLY Return-path =~ /<>/ describe L_hr_NOREPLY Return path is set to empty (common for bounces) score L_hr_NOREPLY 0.6 The score is low enough for me that it doesn't define spam, but it does help flag when a spammer sends spam with no return path. Based on this, I would have no problem with a similar rule, like: header L_hf_NOFROM From =~ /<>/ describe L_hf_NOFROM Sender/From is set to empty score L_hf_NOFROM 0.6 Would this not help if someone is receiving spam with this characteristic? Bob Menschel -----BEGIN PGP SIGNATURE----- Version: PGP 8.0 iQA/AwUBPysd8ZebK8E4qh1HEQK4xQCeKrVxkDHcFm3/WEp+3iGgWK4EkgwAoLUJ ULVl8Ic2KlGFRCDQVE48dgFc =QTZd -----END PGP SIGNATURE----- ------------------------------------------------------- This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET. http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01 _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
