OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: Strange From: in headers

From: Noel Jones (njonesmegan.vbhcs.org)
Date: Mon Jul 23 2007 - 13:08:53 CDT


At 12:58 PM 7/23/2007, Laurent CARON wrote:
> >> Would the following rule be valid in the header checks ?
> >>
> >> /^(From: "\w+ \w+"mydomain\.fr)/ REJECT Mail rejected by rule 228
> >
> > That is a valid rule, and would likely have stopped this mail.
> > Note the (...) parenthesis are unneeded here.
> > Note also this could reject valid mail if you have any users with
> > similar headers.
>
>Are such headers likely to be encountered in a legit mail ?

Depends on what your users set in their mail program, which you may
have little control over. I do receive legit mail with similar
headers from other sites.

> > You also might consider using "reject_unknown_reverse_client_hostname"
> > as part of your smtpd restrictions, which would also have stopped this
> > mail. But this rule may reject some legit mail - you might want to use
> > it for a while proceeded with "warn_if_reject" to see what will be
> > affected without actually rejecting the mail.
> >
> http://www.postfix.org/postconf.5.html#reject_unknown_reverse_client_hostname
>
>We unfortunately did reject a lot of legit mail with that rule, so we
>have to stay away from it :(

Don't confuse this rule with the more strict rule,
reject_unknown_client_hostname (previously named
reject_unknown_client), which is likely to reject lots of legit mail.

--
Noel Jones