On Tue, 20 Nov 2018 16:36:44 +0100
Matus UHLAR - fantomas wrote:
> wasn't FromNameSpoof supposed to catch this kind of mails?
>
> From: "RB Techgum <robert.bxxxxx...@techgum.cz>" <al...@mgff.co.uk>
>
> when testing this with rules proposed in FromNameSpoof docs, none hit.
And it didn't work with:
From: "<robert.bxxxxx...@techgum.cz>" <al...@mgff.co.uk>
but it did work with:
From: "robert.bxxxxx...@techgum.cz" <al...@mgff.co.uk>
Also I got a hit on __PLUGIN_FROMNAME_DIFFERENT with:
From: "al...@mgff.co.uk" <al...@email.mgff.co.uk>
From: "al...@mgff.co.uk" <f...@mgff.org.uk>
this is with 'fns_check 2' where:
Check levels:
0 - Strict checking of From:name != From:addr
1 - Allow for different tlds
2 - Allow for different aliases but same domain
So it looks like:
A. No allowance is made for differing sub-domains.
B. level 1 isn't implied by 2, so it's not possible to allow for both
different local-parts and TLDs
I think it needs some more work.
> because of
> https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7624
> I have applied following patch
> https://svn.apache.org/viewvc/spamassassin/branches/3.4/lib/Mail/SpamAssassin/Plugin/FromNameSpoof.pm?r1=1842029&r2=1842028&pathrev=1842029&view=patch
> - hope it's not the culprit.
It didn't work with the unmodified version either
