Hi, On Tue, Mar 28, 2017 at 2:27 PM, John Hardin <jhar...@impsec.org> wrote: > On Tue, 28 Mar 2017, Dominic Benson wrote: > >>> On 28 Mar 2017, at 19:04, Markus <mar...@clardy.eu> wrote: >>> >>> So you can't compare the "for <m...@example.com>" with "To: >>> doro...@example.com". > > You can do that with a Header ALL rule; it will work more reliably as a > local rule because you know how your local MTA is annotating the envelope > recipient address in the headers, where a rule provided as part of the base > set would be hit-or-miss and hugely complex and would better be done in a > plugin.
It's probably not worth it if it requires a plugin. I had checked the check_for_forged_yahoo_received_headers() function, thought my situation was similar, and suspected this would be the approach. My intention was to create a meta specifically for the users that were targeted most frequently, not a more generic site-wide thing that could hit mailing lists, etc. Would I need to create one ALL rule for each user involved? I don't understand how ALL would help here. alex
