How to block emails from the "From address" - ORF Forums

How to block emails from the "From address" RSS Back to forum

1

We are seeing a big influx of spam emails getting through, where the from address is from an address we would recognise as a contact but it it not from them.
Below is a snip from the mail header.
Date: Wed, 26 Jul 2017 02:29:15 -0500
From: "[email protected]"

So in out look it shows the email is from [email protected]
Is there a way to block emails that have no domain details after the @
I did sender block using *@ but no luck, so i assume the sender block list looks at the actual address not the from address.
Thanks
Russell.

by xtruss 1 year ago
2

@xtruss: Part of the header didn't get pasted in.
The sender is trying to spoof
Outlook just shows [email protected]

Date: Wed, 26 Jul 2017 02:29:15 -0500
From: "[email protected]" WriteMail('jinsauste','levisamty.com');

by russell.singer 1 year ago
(in reply to this post)

3

@russell.singer: A keyword filter, header, regex may help but I think this spammer made a mistake and will likely correct it soon so this rule may only help for a short while.

Keyword, Header, Regex (untested, you may need to adjust it)
.*From: \".+?\@\"

You could also look into ORF's Greylisting, which may help you but could introduce delays.

You could look at the SPF Test, so that when they correct their spam script and add a domain it may not have a valid SPF record, so the SPF test may help there too.

I think all this is in the ORF Best Practices documentation...

by Sam Russo 1 year ago
(in reply to this post)

4

@Sam Russo: Thank you for the reply...
I shall give that ago, but it looks like for now that flurry of spam has no stopped!
We have greylisting and spf implemented, it just seems a constant battle sometimes keeping ahead of the spammers..

by russell.singer 1 year ago
(in reply to this post)

5

@Sam Russo: HI, just to let you know the keyword filter worked a treat, it has caught a load of junk over the weekend.

Thank you.

by russell.singer 1 year ago
(in reply to this post)

New comment

Fill in the form below to add a new comment. All fields are required. If you are a registered user on our site, please sign in first.

It will not be published.
hnp1 | hnp2