<!DOCTYPE html>
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<p><font face="monospace">Hello guys, <br>
</font></p>
<p><font face="monospace">On a postfix-amavis-spamassassin-clamd
system (on Rocky Linux 8) serving as incoming mail gateway, I
would like to try the following to block forged senders: <br>
</font></p>
<p><font face="monospace">If From: field includes a name belonging
to a list of known senders, accept the mail only if the mail
address in the same field is listed in that list. <br>
</font></p>
<p><font face="monospace">For example, an incoming mail arrives with
a From address: <br>
</font></p>
<blockquote>
<pre><font face="monospace">From: "John Smith" <a class="moz-txt-link-rfc2396E" href="mailto:mail1234567@gmail.com"><mail1234567@gmail.com></a> </font></pre>
</blockquote>
<p><font face="monospace">If my list contains: </font></p>
<blockquote>
<pre><font face="monospace">------ /etc/amavisd/known_senders_list -------</font></pre>
<pre><font face="monospace">...
Smith <a class="moz-txt-link-abbreviated" href="mailto:jsmith@example.com,smithj@example.org">jsmith@example.com,smithj@example.org</a>
...</font></pre>
<pre><font face="monospace">---------------------------------
</font></pre>
</blockquote>
<p><font face="monospace">then I would like to quarantine this mail
as spam.</font></p>
<p><font face="monospace">How could I do it?</font></p>
<p><font face="monospace">As an additional/complementary/alternative
approach, I would like to check the mail body to locate the line
with the name which was used in From: field (in the above
example: John Smith or J. Smith or J Smith), and assuming this
is the signature line, I would like to check the following 5-6
lines to find whether one of them contains the name of our
organization, as an example: "ACME Productions". If it does, I
would like to ban (quarantine) the mail if the From: mail
address is NOT on the acme-productions.com domain. This test
could also be assisted by a list of Org names and respective
domains. For example:</font></p>
<blockquote>
<pre><font face="monospace">------ /etc/amavisd/known_org_list -------</font></pre>
<pre><font face="monospace">...
ACME Productions acme-productions.com
...</font></pre>
<pre><font face="monospace">---------------------------------</font></pre>
<p></p>
</blockquote>
<p><font face="monospace">The same could be done for other friendly
domains (banks, mail/courier services, etc).<br>
</font></p>
<p><font face="monospace">How can this be done? <br>
</font></p>
<p><font face="monospace">I am confident that we could block a good
number of spam/phishing attacks using the above logic.</font></p>
<p><font face="monospace">Has anyone implemented the above and
provide some example rules (in amavis or in spam assassin I
would presume)? What is your experience with such approach(es)?<br>
</font></p>
<p><font face="monospace">Thanks in advance!</font></p>
<p><font face="monospace">Best regards,<br>
Nick<br>
</font></p>
<p><font face="monospace"><br>
</font></p>
</body>
</html>