|Subject:||Custom filter for inconsistent sender|
|Creation date:||12/14/15 4:35 PM|
|Last modified on:||12/14/15 4:35 PM|
Sender's email address is sent in twice by the sender SMTP server. The first time it appears in the SMTP communication (RFC 821) and the second time it appears in the email envelope (RFC 822).
Often spammers specify a different address in the first step to prevent SPF detection. Using this rule Xeams can identify if such trick is used.IMPORTANT:
This rule only applies if SPF is used for the sender's domain name. When SPF is not used, this rule does not have affect.
Add a comment to this document
Do you have a helpful tip related to this document that you'd like to share
with other users? Please add it below. Your name and tip will appear at the
end of the document text.