Document information

Document ID:4651
Subject:Custom filter for inconsistent sender
Creation date:12/14/15 4:35 PM
Last modified on:8/10/18 3:17 PM

Inconsistent senders

A sender's email address is sent in twice by the sender's SMTP server. The first time it appears in the SMTP envelope (RFC 821) and the second time it appears in the email envelope (RFC 822). Click here for details about this difference.

Often spammers specify a different address in the envelope to prevent SPF detection. Using this rule Xeams can identify if such trick is used.

IMPORTANT: This rule does not add any score if DMARC is aligned for the email.

Add a comment to this document

Do you have a helpful tip related to this document that you'd like to share with other users? Please add it below. Your name and tip will appear at the end of the document text.
Your name:
Your email:
Hide my email address
Verification code:
Enter the verification code you see above more submitting your tip
Tip:Please limit tips to 1000 characters