Re: filtering UCE with Received: and From: analysis

At 05:15 2012-07-26, Eric Smith wrote:
>Has anyone devised a recipe for checking to see if there is some
>match between the Received: header(s) and the From: and From
>headers?

Well, pretty universally, From: and From_ won't match on _list_ 
messages, and increasingly with auto bounce handling and such, even 
if the List identifies itself as the From: (say, a digest), versus 
merely the Sender:, the From: may have an encoded version of the 
recipient's address in it, possibly with a specific transaction code 
(allowing the list mailsystem to deal with the wide variety of bounce 
formats by just homing in on the address the message bounced to).

What sort of correlation are you expecting to find between the From: 
and a Received: header?  Perhaps you could lay out a set of expected 
correlations and ask how to actually check for them.

---
  Sean B. Straw / Professional Software Engineering

  Procmail disclaimer: <http://www.professional.org/procmail/disclaimer.html>
  Please DO NOT carbon me on list replies.  I'll get my copy from the list.