[Rspamd-Users] Prevent sender address spoofing envelope/header FROM

[Gerald Galster]

> I'd like to block sending out emails that have a different header FROM
> address domain than their envelope FROM address domain.

I don't think there is an easy way to accomplish that and you need to
keep in mind legitimate reasons for "header/envelope from" to differ,
e.g. sender rewriting scheme (SRS).

There is a symbol named FROM_NEQ_ENVFROM which you could use as an
example for a custom lua rule and then act upon authenticated users:

https://github.com/rspamd/rspamd/blob/master/rules/headers_checks.lua
Line 630 - 676.

https://rspamd.com/doc/tutorials/writing_rules.html
https://rspamd.com/doc/lua/

Best regards,
Gerald