Hi, I've been working with a rule to catch forged mail from gmail and yahoo, however, it's hitting some ham now and hoped someone could help. Doesn't gmail allow for configurations where they just relay mail for your hosted domain?
This domain is whitelisted, or it otherwise would have hit. http://pastebin.com/Dk5HGfej This is the rule created by Mark Martinic some time ago. header __L_ML1 Precedence =~ m{\b(list|bulk)\b}i header __L_ML2 exists:List-Id header __L_ML3 exists:List-Post header __L_ML4 exists:Mailing-List header __L_HAS_SNDR exists:Sender meta __L_VIA_ML __L_ML1 || __L_ML2 || __L_ML3 || __L_ML4 || __L_HAS_SNDR header __L_FROM_Y1 From:addr =~ m{[@.]yahoo\.com$}i header __L_FROM_Y2 From:addr =~ m{\@yahoo\.com\.(ar|br|cn|hk|mx|my|ph|sg)$}i header __L_FROM_Y3 From:addr =~ m{\@yahoo\.co\.(id|in|jp|nz|th|uk)$}i header __L_FROM_Y4 From:addr =~ m{\@yahoo\.(ca|cn|de|dk|es|fr|gr|ie|it|pl|ru|se)$}i meta __L_FROM_YAHOO __L_FROM_Y1 || __L_FROM_Y2 || __L_FROM_Y3 || __L_FROM_Y4 header __L_FROM_GMAIL From:addr =~ m{\@gmail\.com$}i meta L_UNVERIFIED_YAHOO !DKIM_VALID && !DKIM_VALID_AU && __L_FROM_YAHOO && !__L_VIA_ML priority L_UNVERIFIED_YAHOO 500 score L_UNVERIFIED_YAHOO 2.5 meta L_UNVERIFIED_GMAIL !DKIM_VALID && !DKIM_VALID_AU && __L_FROM_GMAIL && !__L_VIA_ML priority L_UNVERIFIED_GMAIL 500 score L_UNVERIFIED_GMAIL 2.5 Thanks for any ideas. Alex
