Return-Path: X-Original-To: archive-asf-public-internal@cust-asf2.ponee.io Delivered-To: archive-asf-public-internal@cust-asf2.ponee.io Received: from cust-asf.ponee.io (cust-asf.ponee.io [163.172.22.183]) by cust-asf2.ponee.io (Postfix) with ESMTP id C1AF6200B5E for ; Wed, 10 Aug 2016 15:06:00 +0200 (CEST) Received: by cust-asf.ponee.io (Postfix) id C0588160A93; Wed, 10 Aug 2016 13:06:00 +0000 (UTC) Delivered-To: archive-asf-public@cust-asf.ponee.io Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by cust-asf.ponee.io (Postfix) with SMTP id 147AC160A90 for ; Wed, 10 Aug 2016 15:05:59 +0200 (CEST) Received: (qmail 69982 invoked by uid 500); 10 Aug 2016 13:05:59 -0000 Mailing-List: contact users-help@spamassassin.apache.org; run by ezmlm Precedence: bulk list-help: list-unsubscribe: List-Post: List-Id: Delivered-To: mailing list users@spamassassin.apache.org Received: (qmail 69972 invoked by uid 99); 10 Aug 2016 13:05:58 -0000 Received: from pnap-us-west-generic-nat.apache.org (HELO spamd4-us-west.apache.org) (209.188.14.142) by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 10 Aug 2016 13:05:58 +0000 Received: from localhost (localhost [127.0.0.1]) by spamd4-us-west.apache.org (ASF Mail Server at spamd4-us-west.apache.org) with ESMTP id 7112CC0BB4 for ; Wed, 10 Aug 2016 13:05:58 +0000 (UTC) X-Virus-Scanned: Debian amavisd-new at spamd4-us-west.apache.org X-Spam-Flag: NO X-Spam-Score: -1.427 X-Spam-Level: X-Spam-Status: No, score=-1.427 tagged_above=-999 required=6.31 tests=[RP_MATCHES_RCVD=-1.426, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=disabled Received: from mx1-lw-us.apache.org ([10.40.0.8]) by localhost (spamd4-us-west.apache.org [10.40.0.11]) (amavisd-new, port 10024) with ESMTP id KcpIFt9QuaKq for ; Wed, 10 Aug 2016 13:05:56 +0000 (UTC) Received: from fantomas.fantomas.sk (fantomas.fantomas.sk [62.168.95.114]) by mx1-lw-us.apache.org (ASF Mail Server at mx1-lw-us.apache.org) with ESMTPS id F10715F256 for ; Wed, 10 Aug 2016 13:05:55 +0000 (UTC) Received: from fantomas.fantomas.sk (uhlar@localhost [127.0.0.1]) by fantomas.fantomas.sk (8.14.4/8.14.4/Debian-4+deb7u1) with ESMTP id u7AD5rbS032065 for ; Wed, 10 Aug 2016 15:05:53 +0200 Received: (from uhlar@localhost) by fantomas.fantomas.sk (8.14.4/8.14.4/Submit) id u7AD5rh8032063 for users@spamassassin.apache.org; Wed, 10 Aug 2016 15:05:53 +0200 X-Authentication-Warning: fantomas.fantomas.sk: uhlar set sender to uhlar@fantomas.sk using -f Date: Wed, 10 Aug 2016 15:05:53 +0200 From: Matus UHLAR - fantomas To: users@spamassassin.apache.org Subject: Re: Spoofed Domain Message-ID: <20160810130553.GB25277@fantomas.sk> Mail-Followup-To: users@spamassassin.apache.org References: <406925526.268315.1470779814841.JavaMail.zimbra@sjcourts.org> <1076843314.273472.1470781167719.JavaMail.zimbra@sjcourts.org> <40327140.282736.1470783972051.JavaMail.zimbra@sjcourts.org> <84843a1dd62e3b680b55dbce4359c8aa.squirrel@wuppie.web2all.nl> <73903a3c-90dc-4292-1626-775f19e3f985@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Disposition: inline In-Reply-To: <73903a3c-90dc-4292-1626-775f19e3f985@gmail.com> User-Agent: Mutt/1.5.21 (2010-09-15) archived-at: Wed, 10 Aug 2016 13:06:00 -0000 >On 08/10/2016 10:50 AM, Merijn van den Kroonenberg wrote: >>I wonder if there is a rule which can detect if sender (from) domain >>matches (a) recipient domain. On 10.08.16 11:02, Axb wrote: >There is no such rule in stock SA but it's not too hard to create a >header rule chain containing your rcpt domains in From: and meta >that with a similar list in To: >If the domain list changes frequently, this can probably be automated. note that faking recipients' domain in very common in spam, so I don't think that the rule has any valuable use. -- Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/ Warning: I wish NOT to receive e-mail advertising to this address. Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu. There's a long-standing bug relating to the x86 architecture that allows you to install Windows. -- Matthew D. Fuller