Hi,
I found that many spam, that cannot be rejected by postscreen and rbls, has a unique feature: they are sent through freemailers (mainly gmail in my case) with a freemail From: and a different freemail Reply-To:
So I wrote my own lua rule to compare From: and Reply-To: addresses. The function FREEMAIL_REPLYTO_NEQ_FROM_DOM does a similar thing, but only compares the domain, not the entire address. Inspired by that I wrote a similar function:
-- Requires freemail maps loaded in multimap
local function freemail_reply_neq_from_addr(task)
local frt = task:get_symbol('FREEMAIL_REPLYTO')
local ff = task:get_symbol('FREEMAIL_FROM')
local reply_to = task:get_header('Reply-To')
local mail_from = task:get_from()
if (frt and ff and reply_to ~= mail_from)
then
return true
end
return false
end
rspamd_config:register_symbol({
name = 'FREEMAIL_REPLYTO_NEQ_FROM',
callback = freemail_reply_neq_from_addr,
description = 'Freemail From and Reply-To, but to different Freemail addresses',
score = 10.0,
group = 'headers',
})
rspamd_config:register_dependency('FREEMAIL_REPLYTO_NEQ_FROM', 'FREEMAIL_REPLYTO')
rspamd_config:register_dependency('FREEMAIL_REPLYTO_NEQ_FROM', 'FREEMAIL_FROM')
But I'm asking me, if I could not get the Reply-To-address from the HAS_REPLYTO symbol the same way like the "task:get_symbol('FREEMAIL_REPLYTO')"? I don't know what the "task:get_header('Reply-To')" exactly returns. Propably it will also contain a display name if there, but I need the native mail address for the compare.
Is it possible to get the mail address form the FREEMAIL_REPLYTO symbol? How? How must the code rewritten?