EmailDiscussions.com  

Go Back   EmailDiscussions.com > Email Service Provider-specific Forums > FastMail Forum
Register FAQ Members List Calendar Search Today's Posts Mark Forums Read
Stay in touch wirelessly

FastMail Forum All posts relating to FastMail.FM should go here: suggestions, comments, requests for help, complaints, technical issues etc.

Reply
 
Thread Tools
Old 1 Oct 2018, 07:39 AM   #1
xyzzy
Junior Member
 
Join Date: May 2018
Posts: 8
Looking for opinions on discarding "spam"

I was looking at the headers in various spam emails I get and I noticed a majority of it has an X-Spam-source containing Host='noreverse', i.e., the originator is hiding who they really are. Nothing surprising about that. I only recently switched to using FM as my email service. As an excuse to try to start to get myself acquainted with sieve (and have a little fun) I added the following code to the sieve script at the start just before section 1.

Code:
if not header :matches "X-Spam-Known-Sender" "yes*" {
   if 
      allof(
        header :contains "X-Spam-source" "Host='noreverse'",
        header :value "ge" :comparator "i;ascii-numeric" "X-Spam-score" "5"
      )
   {
      fileinto "INBOX.noreverse";
      stop;
   }
}
Eventually this could be just a discard rule and I could use the UI to do that but I wanted to be sure the theory was valid so I wrote it explicitly to sort the matches into a new folder named "noreverse". That way I could easily see if the stuff I was sorting into there was all truely spam.

Before I turn this into a discard rule I was wondering if there are any exceptions that I might want to actually see. Are there any valid cases where an email classed as spam and has Host='noreverse' where I wouldn't want to just discard it? So far I haven't seen any exceptions. While I don't get a lot of spam (say 5 to 30 a day) it's still easier to look over the remaining spam that doesn't fit this criteria if they aren't listed in the spam folder first place. Maybe for safety I should set the X-Spam-score threshold higher than the usual 5, say 10, 15, 20?

Given the relatively low quantity of spam I get I am not even sure I even want to do this. I'm not totally "in love" with this idea but it was at least an excuse to read the sieve specs and play around a little bit. But it never hurts to ask for other opinions anyhow. I'm just curious what others think about this idea pro or con.

Thanks in advance.
xyzzy is offline   Reply With Quote

Old 1 Oct 2018, 09:48 AM   #2
BritTim
The "e" in e-mail
 
Join Date: May 2003
Location: mostly in Thailand
Posts: 2,665
I have not previously thought about using the fact that the sender is hiding the originator path as part of my spam discard decisions. Off the top of my head, it does make sense. Checking if the email has an apparently valid reply path would also be useful, as many phishing emails send any replies into the ether. I am unsure how often we could determine, in sieve code, if the reply path is valid.
BritTim is offline   Reply With Quote
Reply


Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is Off
HTML code is Off
Forum Jump


All times are GMT +9. The time now is 07:15 AM.

 

Copyright EmailDiscussions.com 1998-2013. All Rights Reserved. Privacy Policy