DoNoFromSelect text says:
Select which check should be done in DoNoFrom .
1 - from: and sender: header tag are both missing
2 - different domains found in from: and sender: email addresses - or multiple
addresses in a single header (FROM: or SENDER:) of different domains are found
4 - multiple from: addresses or from: header tags found (potential 2x score if
option 2 is also enabled)
8 - multiple sender: addresses or sender: header tags found (potential 2x score
if option 2 is also enabled)
16 - no or an invalid email address found in from: header tag
32 - no or an invalid email address found in sender: header tag
Simply form the sum of the numbers in front of the checks you want to select
(0...63). Default vaule is 59 (1+2+8+16+32) - all checks are selected.
Last sentence:
1. ‘vaule’ should be ‘value’.
2. My value was 63 (not sure why) and today I got lots of blocks from the
Clamav mailing list for different from and sender addresses. This is pretty
normal for mailing lists, isn’t it?
host and sender authentications:
host '[10.124.241.7] (7.241.124.10 <>)' authenticated to 'w01.nimastelecom.com'
using 'ESMTPSA'
sender and reply addresses:
MAIL FROM: [email protected] <>
From: [email protected] <>
List-Unsubscribe: [email protected] <>
List-Post: [email protected] <>
List-Help: [email protected] <>
List-Subscribe: [email protected] <>
Reply-To: [email protected] <>
Errors-To: [email protected] <>
Sender: [email protected] <>
recipient addresses:
RCPT TO: [email protected] <>
To: [email protected] <>
using enhanced Originated IP detection for all IP addresses
•detected IP's on the mail routing way: 80.28.132.236 <>(w01.nimastelecom.com)
•detected source IP: 80.28.132.236 <>
Subject: [clamav-users] Unable to compile 0.102.0 -
/usr/lib64/../lib/libstdc++.so
Feature Matching:
• On Global Whitelist <http://localhost:55555/lists>:
'[email protected]' <>
• On Global Whitelist <http://localhost:55555/lists>:
'[email protected]' <>
• On Global Whitelist <http://localhost:55555/lists>:
'[email protected]' <>
• DoNoFrom <http://localhost:55555/#DoNoFrom>: detected (1) faults in scoring
mode - last reason: found (2) different sender domains in 'From:' and 'Sender:'
header tags ( DoNoFrom ) - penalty: 1 * 45 = 45
Will change the value from 63 to 61.
Regards,
James.
_______________________________________________
Assp-test mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/assp-test
