Almost all of the phising mails I can see have (!__ENV_AND_HDR_FROM_MATCH)
Can I simple give a high score to all mails whose header from and env from dont match I will have to whitelist all mailing lists , yahoogroups etc. But is there any other issue with this Thanks Ram
