Spoofed "Mime from"

Author Message
flyok

  • Total Posts : 78
  • Joined: 6/2/2005
  • Location: CZ
  • Status: offline
Spoofed "Mime from" Monday, September 11, 2017 8:26 AM (permalink)
Hi, what could I do with spoofed "mime from" emails?
Some emails loook like to be send from our domain (in email client) but SPF can't catch them because "smtp from" is different than "mime from".
 
 
#1
    bemodern

    • Total Posts : 10
    • Joined: 2/14/2011
    • Status: offline
    Re:Spoofed "Mime from" Wednesday, October 18, 2017 10:18 AM (permalink)
    I Use Advanced Content Filtering  to catch these.
    write a Header regex condition.
     
     
     
    #2
      flyok

      • Total Posts : 78
      • Joined: 6/2/2005
      • Location: CZ
      • Status: offline
      Re:Spoofed "Mime from" Thursday, October 19, 2017 8:15 AM (permalink)
      Be careful with regex!
      I had to disable regex condition in Advanced Content Filtering. Because sometimes (daily) some emails (with big MS office attachment) had been stucked in transport queue for >10 minutes! And a lot of warnings "Event ID 1050 source:MSExchange Extensibility (The execution time of agent 'GfiAvRoutingAgent' exceeded 90000 milliseconds while handling)" had been written in Application Event Log.
       
      #3
        bemodern

        • Total Posts : 10
        • Joined: 2/14/2011
        • Status: offline
        Re:Spoofed "Mime from" Thursday, October 19, 2017 8:56 AM (permalink)
        Ran Regex rules for a few years now with no delay issues. Have Approx 15 rules, receive on average 2000+ emails per day.
         
         
         
        #4
          Online Bookmarks Sharing: Share/Bookmark

          Jump to:

          Current active users

          There are 0 members and 2 guests.

          Icon Legend and Permission

          • New Messages
          • No New Messages
          • Hot Topic w/ New Messages
          • Hot Topic w/o New Messages
          • Locked w/ New Messages
          • Locked w/o New Messages
          • Read Message
          • Post New Thread
          • Reply to message
          • Post New Poll
          • Submit Vote
          • Post reward post
          • Delete my own posts
          • Delete my own threads
          • Rate post

          2000-2018 ASPPlayground.NET Forum Version 3.9