> -----Original Message----- > From: Kai Schaetzl > Jack L. Stone wrote on Sat, 20 Sep 2003 10:08:51 -0500: > > > Research has led me to believe that the "envelope from" is the > > most reliable source of the actual sender. I am prepared to be > > corrected though.... and would like to be. > > > > However, in the case of a spamming virus or a spammer the sender > address is regularly changing. The IP no. in the last Received line > won't change if it is coming from the same sender. I'd be > interested in such a program as well.
The sender, meaning the header From does change. However, the envelope sender is consistent if mail is coming from the same user/machine. However, the envelope sender may change if it is a multi-user host. On the other hand, the Received line you are suggesting may change if the IP address is dynmically assigned. I don't think that either is more reliable than the other and both are probably the best to use. --Larry ------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ Spamassassin-talk mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/spamassassin-talk
