[Mailman-Users] Detecting mail with multiple From: lines

[Jay A. Sekora]

Thanks very much, Mark; this is exactly what I needed to know!

> To answer your question, put a regexp like
> 
> (?s)\nFrom:.*\nFrom:
> 
> in Privacy options... -> Spam filters -> header_filter_rules. These
> regexps are searched in IGNORECASE and MULTILINE mode. The (?s) will
> set DOTALL (dot matches all) mode as well. Your regexp will be
> searched for in a string consisting of all the message headers and
> will catch multiple From: headers. Give that rule an appropriate
> action and you're set.

Great, that's perfect!  In theory I suppose the regex should be extended
to handle multiple addresses in a single From: line, but since spammers
seem exclusively to be using multiple From: lines at the moment, I'm not
going to try to compose a regex that handles quoting and commenting in
From: lines properly to detect multiple recipients. :-)

Jay