ram writes: > Almost all of the phising mails I can see have > (!__ENV_AND_HDR_FROM_MATCH) > > Can I simple give a high score to all mails whose header from and env > from dont match > > I will have to whitelist all mailing lists , yahoogroups etc. But is > there any other issue with this
it's *extremely* common in nonspam -- appears in 26% of our test corpora in fact. That's a *lot* of whitelisting. http://ruleqa.spamassassin.org/?q=__ENV_AND_HDR_FROM_MATCH --j.
