Document information
| Document ID: | 4651 |
|---|---|
| Subject: | Custom filter for inconsistent sender |
| Creation date: | 12/14/15 4:35 PM |
| Last modified on: | 8/10/18 3:17 PM |
Inconsistent senders
A sender's email address is sent in twice by the sender's SMTP server. The first time it appears in the SMTP envelope (RFC 821) and the second time it appears in the email envelope (RFC 822). Click here for details about this difference.Often spammers specify a different address in the envelope to prevent SPF detection. Using this rule Xeams can identify if such trick is used.
IMPORTANT: This rule does not add any score if DMARC is aligned for the email.
Add a comment to this document
Do you have a helpful tip related to this document that you'd like to share with other users?
Important: This area is reserved for useful tips. Therefore, do not post questions here. Instead, use our public forums to post questions.