Tuesday, September 08, 2009

Blocking spam that appears to come from your own email address

At work, I get a lot of email where the sender has spoofed the email address so that it appears to come my work email address.  It’s annoying and our corporate email filter doesn’t catch it.  I did find a way to block it with a close to 100% success rate.  What I did was to create an email filter in the email application that traps those messages.  I’m using Outlook 2007, but the technique should would work for any email client that has decent filtering.  Here’s how I created the rule (using an obviously fake email address of a known spammer):

1.       From the Tools menu, select “Rules and Alerts…”

2.       From the “Rules and Alerts…” dialog, press the  “New Rule…” button.

3.       Under “Start from a blank rule” section, select “Check messages when they arrive” template.

4.       Under the dialog for “Which condition(s) do you want to check?”, select "with specific words in the message header"

5.       Click on “specific words” to open the dialog box that allows you to enter the search criteria.  I entered the following list, you would enter what matches your junk email and each line is entered in separately:
X-Barracuda-Envelope-From: sanford.wallace@spamking.com

From: <sanford.wallace@spamking.com>

6.       After closing this dialog, press “Next”

7.       On the “What do you want to do with the message?” dialog, select the following actions:
mark it as read

clear the Message Flag

move it the specified folder

8.       Click on "specified" and select the "Junk E-mail" folder.

9.       Click the “Next” button to the Finish rule setup dialog.

10.   Name the rule and set "Turn on this rule".  There is also a checkbox “Run this rule on messages already in “Inbox”.  You can set that checkbox to test the new rule.  If you have lots of messages in your inbox, create a new folder and copy some of the spam into that folder.  Then select that folder and edit the rule.  The “Run this rule…” checkbox will now list the name of the selected mail folder.  Your rule will run much faster on a mail folder with just a few times in it.

 

As you edit the settings, Outlook will display a text representation of the rule as you configure it.  It should look something like this:

Apply this rule after the message arrives
with ‘X-Barracuda-Envelope-From: sanford.wallace@spamking.com or From: <sanford.wallace@spamking.com>‘ in the message header
clear the message flag
  and move it to the Junk E-Mail folder
  and mark it as read

You may need to tweak the rule a bit to match the right messages, but it’s fairly robust.  If you want to allow email from your own address, add an exception to the rule and have the exception match some specific text in your message header or your email signature.

No comments:

Post a Comment

Note: Only a member of this blog may post a comment.