On Sat, 04 Oct 2014 13:59:54 +0200 Benny Pedersen <m...@junc.eu> wrote:
> On October 4, 2014 4:08:00 AM "David F. Skoll" > <d...@roaringpenguin.com> wrote: > > So it occurs to me that if > > a mail comes in with a Return-Path: header that does not match > > the envelope sender, that's another very suspicious sign. > As this mail list here :) Eh? Here are headers from your message: Return-Path: <users-return-105527-dfs=roaringpenguin....@spamassassin.apache.org> Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by colo3.roaringpenguin.com (8.14.3/8.14.3/Debian-9.4) with SMTP id s94C75ki001614 for <d...@roaringpenguin.com>; Sat, 4 Oct 2014 08:07:13 -0400 And logs: colo3:~$ fgrep s94C75ki001614 /var/log/mail.log|grep from= Oct 4 08:07:13 colo3 sm-mta[1614]: s94C75ki001614: from=<users-return-105527-dfs=roaringpenguin....@spamassassin.apache.org>, size=2971, class=0, nrcpts=1, msgid=<148db07ca90.280b.d475fad7b14312f5d8424e35e39f7...@junc.eu>, proto=SMTP, daemon=MTA, relay=hermes.apache.org [140.211.11.3] The envelope sender and Return-Path: header match. Regards, David.
