Skip site navigation (1)Skip section navigation (2)

FreeBSD Manual Pages

  
 
  

home | help
Mail::SpamAssassin::PlUser:Contributed:PerlmAssassin::Plugin::FromNameSpoof(3)

NAME
       FromNameSpoof - perform various tests to	detect spoof attempts using
       the From	header name section

SYNOPSIS
       loadplugin    Mail::SpamAssassin::Plugin::FromNameSpoof

	# Does the From:name look like it contains an email address
	header	 __PLUGIN_FROMNAME_EMAIL  eval:check_fromname_contains_email()

	# Is the From:name different to	the From:addr header
	header	 __PLUGIN_FROMNAME_DIFFERENT  eval:check_fromname_different()

	# From:name and	From:addr owners differ
	header	 __PLUGIN_FROMNAME_OWNERS_DIFFER  eval:check_fromname_owners_differ()

	# From:name domain differs to from header
	header	 __PLUGIN_FROMNAME_DOMAIN_DIFFER  eval:check_fromname_domain_differ()

	# From:name and	From:address don't match and owners differ
	header	 __PLUGIN_FROMNAME_SPOOF  eval:check_fromname_spoof()

	# From:name address matches To:address
	header __PLUGIN_FROMNAME_EQUALS_TO  eval:check_fromname_equals_to()

DESCRIPTION
       Perform various tests against From:name header to detect	spoofing.
       Steps in	place to ensure	minimal	FPs.

CONFIGURATION
       The plugin allows you to	skip emails that have been DKIM	signed by
       specific	senders:

	fns_ignore_dkim	googlegroups.com

       FromNameSpoof allows for	a configurable closeness when matching the
       From:addr and From:name,	the closeness can be adjusted with:

	fns_extrachars 50

       Note that FromNameSpoof detects the "owner" of a	domain by the
       following search:

	<owner>.<tld>

       By default FromNameSpoof	will ignore the	TLD when testing if From:addr
       is spoofed.  Default 1

	 fns_check 1

       Check levels:

	0 - Strict checking of From:name != From:addr
	1 - Allow for different	tlds
	2 - Allow for different	aliases	but same domain

TAGS
       The following tags are added to the set if a spoof is detected. They
       are available for use in	reports, header	fields,	other plugins, etc.:

	 _FNSFNAMEADDR_
	   Detected spoof address from From:name header

	 _FNSFNAMEDOMAIN_
	   Detected spoof domain from From:name	header

	 _FNSFNAMEOWNER_
	   Detected spoof owner	from From:name header

	 _FNSFADDRADDR_
	   Actual From:addr address

	 _FNSFADDRDOMAIN_
	   Actual From:addr domain

	 _FNSFADDROWNER_
	   Actual From:addr detected owner

EXAMPLE
       header	__PLUGIN_FROMNAME_SPOOF	eval:check_fromname_spoof() header
       __PLUGIN_FROMNAME_EQUALS_TO eval:check_fromname_equals_to()

       meta	FROMNAME_SPOOF_EQUALS_TO  (__PLUGIN_FROMNAME_SPOOF &&
       __PLUGIN_FROMNAME_EQUALS_TO) describe FROMNAME_SPOOF_EQUALS_TO
       From:name is spoof to look like To: address score
       FROMNAME_SPOOF_EQUALS_TO	1.2

perl v5.32.0			  Mail::SpamAssassin::Plugin::FromNameSpoof(3)

NAME | SYNOPSIS | DESCRIPTION | CONFIGURATION | TAGS | EXAMPLE

Want to link to this manual page? Use this URL:
<https://www.freebsd.org/cgi/man.cgi?query=Mail::SpamAssassin::Plugin::FromNameSpoof&sektion=3&manpath=FreeBSD+12.2-RELEASE+and+Ports>

home | help