spamassassin-users October 2010 archive
Main Archive Page > Month Archives  > spamassassin-users archives
spamassassin-users: Re: Checking FROM FIELD for Keywords

Re: Checking FROM FIELD for Keywords

From: John Hardin <jhardin_at_nospam>
Date: Thu Oct 14 2010 - 14:55:13 GMT

On Thu, 14 Oct 2010, wvpTV wrote:

> We've seen a recent explosion in spam that SpamAssassin does not flag,
> it seems mainly because the FROM (sender) field is being used for
> subject content, eg: VIAGRA, PORN etc etc
> Can anyone tell me how far off a standard filter update might be to
> carry out checks on the FROM field?

There is a FROM_IN_TO_AND_SUBJ rule in my sandbox that is performing well
in masschecks. I believe it's in the current sa-update.

You might want to check your scores, though; it hasn't been around long
enough to go through a net masscheck so some of the scores are still

If this rule isn't appropriate, could you post a spample to pastebin so I
can get a look at the headers?


-- John Hardin KA7OHZ FALaholic #11174 pgpk -a key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79 ----------------------------------------------------------------------- People seem to have this obsession with objects and tools as being dangerous in and of themselves, as though a weapon will act of its own accord to cause harm. A weapon is just a force multiplier. It's *humans* that are (or are not) dangerous. ----------------------------------------------------------------------- 64 days until TRON Legacy