Rule based Blacklist Problem

[eistek]

Hi ,

The mail address info@insaninternational.org is sending spam all the day. I have added "insaninternational.org" to

"Mail Filter / Who Objects / Blacklist" as a Domain. But i am still getting mails.

Also tried to add "info@insaninternational.org" to "Mail Filter / Who Objects / Blacklist" as a Email.

Result is not changed

Then I have checked Tracking center. What i see in tracking center is ;



The question is why From is noreply@hedefmail6.com instead of info@insaninternational.org ?

And this is what i see in Spam Quarantine;




Delivered-To: export@domain.com.tr
Return-Path: noreply@hedefmail6.com
Received-SPF: pass (hedefmail6.com: 185.242.160.90 is authorized to use 'noreply@hedefmail6.com' in 'mfrom' identity (mechanism 'a' matched)) receiver=pmx.mygateway.net; identity=mailfrom; envelope-from="noreply@hedefmail6.com"; helo=hizhosting.com; client-ip=185.242.160.90
Received: from hizhosting.com (unknown [185.242.160.90] by pmx.mygateway.net (Proxmox) with ESMTP id 11CCD341860 for <export@domain.com.tr>; Tue, 29 Dec 2020 02:46:09 +0300 (+03)
Received: by hizhosting.com (Postfix, from userid 0) id EA2D5334FCBC; Tue, 29 Dec 2020 02:16:29 +0300 (+03)
To: export@domain.com.tr
subject: SPAM: =?UTF-8?B?VXpha3RhbiBFxJ9pdGltZSBEZXN0ZWsgWcSxbGJhxZ/EsSBQcm9qZXNpIEhha2vEsW5kYQ==?=
X-PHP-Originating-Script: 10000:email.php
Message-ID: <dc0b11cb086b1302c3fcdcd5d1897458@www.hedefmail6.com>
Date: Mon, 28 Dec 2020 23:31:12 +0300
From: "=?UTF-8?B?xLBOU0FOIMSwbnRlcm5hdGlvbmFs?=" <info@insaninternational.org>
Reply-To: info@insaninternational.org
MIME-Version: 1.0

 

[Stoiko Ivanov]

Who Objects (like e.g. the Blacklist who objects) match on smtp-envelope addresses (for this mail noreplay@hedefmail6.com) - since this is the address which sends the mail during the smtp-dialogue
The From you're seeing is the From-header (RFC5322 from)

The difference is explained on quite a few howtos and posts on the internet (also in this forum) - e.g.
https://serverfault.com/questions/5...-mail-from-will-not-match-from-header-in-data

I hope this explains it!

 

[eistek]

Who Objects (like e.g. the Blacklist who objects) match on smtp-envelope addresses (for this mail noreplay@hedefmail6.com) - since this is the address which sends the mail during the smtp-dialogue
The From you're seeing is the From-header (RFC5322 from)

The difference is explained on quite a few howtos and posts on the internet (also in this forum) - e.g.
https://serverfault.com/questions/5...-mail-from-will-not-match-from-header-in-data

I hope this explains it!

Thanx for your reply

Is there any way to add "From-header (RFC5322 from) " as Who object?

 

[Stoiko Ivanov]

Try adding a 'Match field' what object - Field: 'From' - value a regular expression matching the domain/e-mail address
see https://pmg.proxmox.com/pmg-docs/pmg-admin-guide.html#chapter_mailfilter

 

[eistek]

Try adding a 'Match field' what object - Field: 'From' - value a regular expression matching the domain/e-mail address
see https://pmg.proxmox.com/pmg-docs/pmg-admin-guide.html#chapter_mailfilter

Thanks for your support.