On Aug 29, 2013, at 6:41 AM, "RW" <rwmailli...@googlemail.com> wrote:
> On Thu, 29 Aug 2013 00:55:29 +0200 > Michael Schaap wrote: > > > On 29-Aug-2013 00:30, John Hardin wrote: > > > On Wed, 28 Aug 2013, Michael Schaap wrote: > > > > > >> Hi, > > >> > > >> I'm getting loads of fake LinkedIn invites, most of which aren't > > >> caught by SpamAssassin. > > >> Does anyone have a good SpamAssassin rule to catch those, while > > >> letting real LinkedIn invites through? > > > Do they fail SPF or DKIM? > > > > > The "From:" header is at linkedin dot com, but the envelope sender is > > a random address > > I'm guessing that legitimate linkedin mail has something other than a > random address in its envelope sender. > Greylisting kills these off nicely. I have one account without greylisting enabled and I get a couple of these fake linkedin spams a week. Never seen one on any of my non-greylisted accounts. >
