On Mon, 28 Sep 2015 15:28:52 -0500 (CDT) David B Funk wrote:
> In the OP's context "may be forged" indicates FCDNS failed. This > could be due to a deliberate obfuscation attempt or a simple > temporary network/DNS issue. > > The "Botnet" plugin will catch those as well as other kinds of > DNS/hostname type indications and allow score adjustments. And if you do test for "may be forged", make sure it only matches on the MX received header.
