Attachment blocking with spoofed addresses and DMARC

Quanah Gibson-Mount quanah at
Fri Apr 15 01:27:42 CEST 2016

A customer who has set up DKIM + SPF notes a spammer tactic where they set 
the TO and FROM to be the same value.  I.e.,:

To: user at
From: user at

With an attachment type that has been set up to be blocked.  Even though 
the message clearly fails DMARC and thus will be flagged as Junk in our 
setup (SA scores DMARC failure with a large negative score), the user ends 
up getting a notification for every one of these emails.  Is there any way 
to get Amavis to NOT send a notice to the user if the SA score is above the 
SPAM threshold?



Quanah Gibson-Mount
Platform Architect
Zimbra, Inc.
Zimbra ::  the leader in open source messaging and collaboration
A division of Synacor, Inc

More information about the amavis-users mailing list