On Mon, 16 Oct 2017 13:19:06 -0400 Mark London wrote: > Hi - I received a spam message with the following double From address: > > From: struth...@psfc.mit.edu, "Lorraine M." > <alexa.mora...@glcamerica.com> > > But neither of the 2 previously suggested rules were triggered by > it. I'm sure a simple modification to the rules will cause it to > trigger.
Those rules are looking for a email address in the display name plus a specific RFC violation; so they only hit a subset of that type. This one is quite different. > Can we get an official rule to test for invalid double addresses? It's unusual, but it's not an invalid header. An email can have multiple authors in the from header provided there is a Sender header. It was discussed here: https://bz.apache.org/SpamAssassin/show_bug.cgi?id=6781 It does seem to be triggering a bug in SA. From: struth...@psfc.mit.edu, "Lorraine M." <alexa.mora...@glcamerica.com> is parsed as one address __FROM_ADDR ======> got hit: "alexa.mora...@glcamerica.com" __FROM_NAME ======> got hit: "struth...@psfc.mit.edu, Lorraine M." Reported here: https://bz.apache.org/SpamAssassin/show_bug.cgi?id=7479
