GFI Forums: Kerio Connect » External Email Warning

Home » GFI User Forums » Kerio Connect » External Email Warning (Add warning when email was not sent from domain)

Show: Today's Messages :: Show Polls :: Message Navigator
E-mail to friend

Re: External Email Warning [message #152535 is a reply to message #149578]

Sat, 20 August 2022 05:56

Rahm-o
Messages: 8
Registered: September 2013

This is a revision to the sample filter code mentioned in an earlier post.

I've added the "at sign" (yes, I spelled that out, because the forum doesn't allow the sign) before your domain name. It's necessary because spammers/scammers are adding in YOUR domain name into the return path of their emails, which then allows those emails to get past the filter code if it's written as described in the earlier post. By doing this, it filters the use of your own domain name in the Return Path.

This is an example of how they put your domain into the return path (visible in mail headers):

Return-Path: <bounces+12345678-myemail=mydomain.com<_at_>spammerdomain.com >

OK, so here's how you should write the filter:

ALL of the following conditions must be met:
FROM - DOES NOT CONTAIN - <_at_>mydomain.com
SENDER - DOES NOT CONTAIN - <_at_>mydomain.com
SUBJECT - DOES NOT CONTAIN - [EXTERNAL]

Perform the following actions:
CHANGE HEADER - SUBJECT - [EXTERNAL] ${subject}

DON'T ACTUALLY ADD "<_at_>" BEFORE YOUR DOMAIN NAME - REPLACE IT WITH THE "AT SIGN" - THE GFI FORUM PREVENTS THAT SIGN FROM BEING ENTERED. SEE THE ATTACHED SCREENSHOT FOR CLARITY.

/index.php?t=getfile&id=5361&private=0

In regards to the question as to why you need to have both FROM and SENDER in the filter: both of these fields are used in email sending. The SENDER domain is what the receiving email server sees when initiating the session. The FROM address is what your recipients will see. Including both is a way to ensure both are covered.

Attachment: external-warning.png
(Size: 122.70KB, Downloaded 878 times)

[Updated on: Fri, 26 August 2022 10:59] by Moderator

Report message to a moderator

[Message index]

		External Email Warning By: ohioits on Thu, 08 April 2021 15:11
		Re: External Email Warning By: brandonh75 on Tue, 13 April 2021 15:46
		Re: External Email Warning By: OliviaParcker on Thu, 15 April 2021 11:05
		Re: External Email Warning By: Bud Durland on Wed, 19 October 2022 17:38
		Re: External Email Warning By: freakinvibe on Fri, 16 April 2021 09:17
		Re: External Email Warning By: nitrocoffee on Tue, 16 November 2021 11:43
		Re: External Email Warning By: jdavidson on Fri, 22 April 2022 20:59
		Re: External Email Warning By: Nick.Geary on Sat, 23 April 2022 00:08
		Re: External Email Warning By: raymondalston on Mon, 22 August 2022 10:12
		Re: External Email Warning By: Rahm-o on Sat, 20 August 2022 05:56
		Re: External Email Warning By: raymondalston on Mon, 22 August 2022 10:14
		Re: External Email Warning By: npaul62 on Fri, 07 October 2022 16:15
		Re: External Email Warning By: robinbateman on Wed, 19 October 2022 14:37
		Re: External Email Warning By: Tip32a on Fri, 03 February 2023 14:26

Previous Topic:	Anti Virus stopped
Next Topic:	2 Server with 2 different domains

Goto Forum:

-=] Back to Top [=-

[ Syndicate this forum (XML) ] [

] [

]

Current Time: Mon Oct 02 21:36:47 CEST 2023

Total time taken to generate the page: 0.06572 seconds