[Rspamd-Users] how to score fake senders

[Ronny Seffner]

Hi,

I wonder how to score faked senders which uses domain of recipient.

At the moment I got mails with header FROM '"Some Body <somebody at mydomain.tld>" <another at spammer.tld>'.
So my users see in their MUAs, its from 'mydomain.tld' and they like to trust these mails. (It should be a task of the MUA to show the real sender address)

Why not to look for headers TO domain.tld inside FROM (before last "<" bracket) and if found to give the mail a bad scoring?
What about mails inside an domain.tld? No problem if internal mailserver is another than rspamd.

Did I miss something?


with regards

Ronny Seffner