On Fri, 2009-01-16 at 18:51 +0000, Rik wrote: > On Fri, 2009-01-16 at 19:25 +0100, Matus UHLAR - fantomas wrote: > > On 16.01.09 11:26, Helmut Schneider wrote: > > > can I (and if how) create a filter that catches mails _from_and_to_ > > > specific email addresses? It should only apply if a specific sender sendw > > > an email to a specific recipient. > > > > I'd start searching in yout MTA's documentation. It's not job of SA to do > > such things... > > Despite the fact it's a common spam attack - this kind of spoofing - > SA seems unable to deal with it. This is because it's 'complex'. > > That was the best answer I got when asking it some months ago. > You could try something like this:
describe LOCSRS Sender same as recipient header __LOCSR1 To =~ /\...@example.com/i header __LOCSR2 From =~ /\...@example.com/i meta LOCSRS (__LOCSR1 && __LOCSR2) score LOCSRS 6.0 but please note the following points: - This example rule has neither been compiled or tested. As it was scribbled down in a hurry it may have defects, so you need to test it carefully and exhaustively. - Put it in local.cf where sa_update can't touch it. - Replace 'example.com' with your domain name. - This should be OK for cases where you are the only user because it WILL mark mail between users in your domain as spam. - If you use the one MTA to handle mail for multiple domains it is unlikely to do what you want. Martin
