|Subject:||Custom filter for inconsistent sender|
|Creation date:||12/14/15 4:35 PM|
|Last modified on:||8/10/18 3:17 PM|
A sender's email address is sent in twice by the sender's SMTP server. The first time it appears in the
SMTP envelope (RFC 821) and the second time it appears in the email envelope (RFC 822). Click here
for details about this difference.
Often spammers specify a different address in the envelope to prevent SPF detection.
Using this rule Xeams can identify if such trick is used.
This rule does not add any score if DMARC is aligned for the email.
Add a comment to this document
Do you have a helpful tip related to this document that you'd like to share
with other users? Please add it below. Your name and tip will appear at the
end of the document text.