I received a spam and the field "From" looks like this (I have anonymized the field):

John Doe <john.doe@company.com> John Doe [mailto:data@firewall.tz]

  • How this field has been built? The information in bold corresponds to what?
  • Which rule can I implement to block it? Example: If an email address between square brackets is indicated AND it doesn't match the email address indicated between angle bracket then refuse the email?

I suppose that the "true" email of the sender is data@firewall.tz but usually only the two first pieces of information are showed in the field "From" (the display name and the <email address>).

closed as unclear what you're asking by Steffen Ullrich, Steve, Xander, Serge Ballesta, Matthew Apr 24 '17 at 8:06

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • One is the reply or from address, the other is the sender address. This info can be found in multiple places online. – schroeder Apr 20 '17 at 11:29
  • 2
    You are only showing how the From header is presented by your unknown e-mail program. And you are asking how to block such mails by your unknown mail filter which has unknown filter capabilities. More useful would be the source code of the mail header instead of the representation shown by the mail client. As for how this field is build have a look at RFC 2822. – Steffen Ullrich Apr 20 '17 at 11:30
  • @SteffenUllrich : I do not have the source code of the original email because it have been transmitted to me. I am going to try to get it. The only thing I have is this John Doe &lt;<a href="mailto:john.doe@company.com">john.doe@company.com</a>&gt; John Doe [<a href="mailto:data@firewall.tz">mailto:data@firewall.tz</a>] but I do not think it will help you. – C.K. Apr 20 '17 at 11:57

If it was straightforward to create a rule to block this, then every client would do it - the problem is legitimate mail re-senders, like constantcontact, mailchimp, etc. would be blocked, too. Even tech support departments use this technique.

In short, you could do it, but you probably wouldn't want to.

  • What surprised me is we have anti-spoofing rules in my company. So it should not be possible to usurp the email address of John Doe (who is a legitimate employee of my company) and send email with his email address from outside our network. – C.K. Apr 20 '17 at 12:01
  • 1
    I can set the From to whatever I like and not engage any anti-spoofing if I also set the true source address. – schroeder Apr 20 '17 at 12:38
  • Sometimes in the field "From", there is just an email address between angle brackets, others times an email address between square brackets and other times (like in my case) an email address A between angle brackets AND an email address B between square brackets. I thought that only what is showed between the angle brackets is not reliable and can be easily modified. So why the information display are different according to the emails you receive ? – C.K. Apr 21 '17 at 13:39

Many email clients have functionality to block emails based on the sender's address. Often these options are found in the program's Spam or Junk Mail options, implying this feature is useful for dealing with this type of email.

However, forging the From address of an email is trivial, making the block sender feature worthless for spam. To make matters worse, most email systems limit the number of entries that can be added to the block list, so the first 200 spammers lame enough to use the same From address twice will get blocked while the next 2000 would keep getting through.

An email program's Block Sender feature is more useful for blocking messages from that annoying uncle you only see at funerals that forwards every lame joke email he gets.

When it comes to blocking spam, the best solution is to use a dedicated spam and virus filtering service. They use sophisticated techniques to identify spam based on a whole host of factors and the most advanced update their rules every few minutes.

Not the answer you're looking for? Browse other questions tagged or ask your own question.