RE: Problem with a Rule

[Andy Jezierski]

"Gray, Richard" <[EMAIL PROTECTED]> wrote on 03/03/2005 10:03:16 AM:

> Use
>
> header  LOCAL_MAIL From =~ /[EMAIL PROTECTED]/I
>
> Alternatively
>
> whitelist_from [EMAIL PROTECTED]
>
> This is generally not considered a good idea tho, because these headers
> are very easy to forge. (viruses tend to masquarade as
> internal->internal mail)
>
If you do this, I'd also try to find another header that you can check that would allow you to identify this message as originating from an internal user and make it a meta rule. Like everyone says, From addresses are easily spoofed.

Andy