Recently, I have noticed a pattern of receiving spam emails with the From address that seemed legitimate, but the Reply To field questionable. For example,
From: daceylockerby@yahoo.com
Reply To: iryjygycyq@yandex.ru
Please add Blacklist filter by Reply To address, or combined filter of From + Reply To field. If any field matches my filter input, I want to reject that email.
Blacklist filter by Reply To field
Moderator: Moderators
Re: Blacklist filter by Reply To field
Both of "From" and "Reply-To" are header fields from the content (the DATA portion). The blacklist works on SMTP session (stuff before DATA, like MAIL FROM), it doesn't look at the actual content of the message. This is not to say it's impossible to check the headers in the body, just that it will require a separate blacklist implementation, not something we can quickly add to the existing blacklist as options.
The "From" field is very often, but not always, the same value as the SMTP session MAIL FROM value. The most common time they won't be the same is with mailing lists where the MAIL FROM is some kind of unique address (typically for bounce identification) and the From header is a "friendly" value.
The "From" field is very often, but not always, the same value as the SMTP session MAIL FROM value. The most common time they won't be the same is with mailing lists where the MAIL FROM is some kind of unique address (typically for bounce identification) and the From header is a "friendly" value.
Seth Mattinen, Roller Network LLC