GFI Software

Welcome to the GFI Software community forum! For support please open a ticket from https://support.gfi.com.

Home » GFI User Forums » Kerio Connect » External Email Warning (Add warning when email was not sent from domain)
Re: External Email Warning [message #152535 is a reply to message #149578] Sat, 20 August 2022 05:56 Go to previous messageGo to previous message
Rahm-o is currently offline  Rahm-o
Messages: 8
Registered: September 2013
This is a revision to the sample filter code mentioned in an earlier post.

I've added the "at sign" (yes, I spelled that out, because the forum doesn't allow the sign) before your domain name. It's necessary because spammers/scammers are adding in YOUR domain name into the return path of their emails, which then allows those emails to get past the filter code if it's written as described in the earlier post. By doing this, it filters the use of your own domain name in the Return Path.

This is an example of how they put your domain into the return path (visible in mail headers):

Return-Path: <bounces+12345678-myemail=mydomain.com<_at_>spammerdomain.com >

OK, so here's how you should write the filter:


ALL of the following conditions must be met:
FROM - DOES NOT CONTAIN - <_at_>mydomain.com
SENDER - DOES NOT CONTAIN - <_at_>mydomain.com
SUBJECT - DOES NOT CONTAIN - [EXTERNAL]

Perform the following actions:
CHANGE HEADER - SUBJECT - [EXTERNAL] ${subject}


DON'T ACTUALLY ADD "<_at_>" BEFORE YOUR DOMAIN NAME - REPLACE IT WITH THE "AT SIGN" - THE GFI FORUM PREVENTS THAT SIGN FROM BEING ENTERED. SEE THE ATTACHED SCREENSHOT FOR CLARITY.


/index.php?t=getfile&id=5361&private=0


In regards to the question as to why you need to have both FROM and SENDER in the filter: both of these fields are used in email sending. The SENDER domain is what the receiving email server sees when initiating the session. The FROM address is what your recipients will see. Including both is a way to ensure both are covered.

[Updated on: Fri, 26 August 2022 10:59] by Moderator

Report message to a moderator

 
Read Message
Read Message
Read Message
Read Message
Read Message
Read Message
Read Message
Read Message
Read Message
Read Message
Read Message
Read Message
Read Message
Previous Topic: KC 9.4.2 experiences?
Next Topic: Calendar Availability Mac OS Big Sur
Goto Forum:
  


Current Time: Fri Feb 03 12:22:17 CET 2023

Total time taken to generate the page: 0.02142 seconds