I'm using postfix (3.1.12) and receiving spam with prevents to be sent from my email address to me. The trick the spammer does is to differ the FROM mail address and the from address in the DATA header.

Jun 13 01:48:01 localhost postfix/cleanup[57940]: AD3DDE06BE: message-id=<3284866135.1622311732354561837738079581085.JavaMail.app@jno.rqlr>
Jun 13 01:48:01 localhost postfix/qmgr[31745]: AD3DDE06BE: from=<prvs=60660779a3=gpstemmet@telkomsa.net>, size=241607, nrcpt=1 (queue active)
Jun 13 01:48:01 localhost postfix/local[57941]: AD3DDE06BE: to=<xxx@yyy.tld>, relay=local, delay=1.8, delays=1.8/0.02/0/0.02, dsn=2.0.0, status=sent (delivered to maildir)

But in mail header

Date: Thu, 13 Jun 2019 01:47:22 +0200
Message-ID: <3284866135.1622311732354561837738079581085.JavaMail.app@jno.rqlr>
From: <xxx@yyy.tld>
Errors-To: no-reply@mail.telkomsa.net
Subject: xxx
Feedback-ID: 5:hc_gfxoi_okpbsv:laceq
X-Sender: gpstemmet@telkomsa.net
List-Unsubscribe: <http://telkomsa.net/sm/unsubscribe/do?hash=5248854>
To: xxx@yyy.tld

I founded many scripts and ways to block a list of specific FROM addresses with header_check using regular expressions.

But is there a way to use header_check verifying that the FROM and the DATA FROM are equal ?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.