On 22/02/2021 15:05, RW wrote:
On Sun, 21 Feb 2021 16:32:01 -0800 (PST)
John Hardin wrote:
On Sun, 21 Feb 2021, John Hardin wrote:
On Sun, 21 Feb 2021, Dominic Raferd wrote:
Michael's suggestion is interesting. There is a github project
allowing Levenshtein numbers to be calculated and used in SA, I
will see if there is a way to apply it in this situation. Thanks
to all for their input.
It would have to be a plugin, and there's a CPAN module for
calculating Levenshtein numbers so most of the heavy lifting is
already done.
Sigh. Ignore that, that's exactly what it is. I need to stop replying
so quickly to stuff.
I don't think there was anything wrong in pointing out that it's
available from CPAN.
There is also a Damerau–Levenshtein version which is probably a better
choice as the transposition of two adjacent characters counts as 1
difference rather than 2.
That sounds better, but I don't know how to employ it to make a rule for
SA. My idea is to compare the domain part of the 'From' and 'Reply-To'
addresses, scoring for a close but not exact match (maybe
Damerau–Levenshtein between 1 and 3). The same logic could also be used
to compare the domain part of the 'From' to a list of domains that are
prone to impersonation (and don't have DMARC policy with
p=reject|quarantine).
