On Tue, 12 Jan 2010, Callum Millard wrote: : The problem is spam with a faked 'From:' field. Spammers are sending : e-mails to our domain with the 'From:' field set to a valid e-mail : address from our domain.
Key question: Can your users send mail 'From' their internal addresses via ANY intrnet connection, or MUST they use your mail server via approved internal connections? In the latter case, you can use the suggested check for domains, or set up your SPF record for your domain. Unfortunately, if you permit use of your domain name as a 'From' for users on other connections (home DSL, etc), then you can only use a minimal score in SA and must look for other spamsign. - Charles
