This plugin was introduced in Spamassassin 3.4.2.
This plugin performs various tests against the display name in the From: header (From:name) to detect spoofing, with steps in place to keep false positives to a minimum.
The plugin compares the From:name display name against the actual From: address, and in separate tests against the To: and Reply-To: addresses, to detect spoofing. The fns_check setting controls how strict the From:name/From:addr comparison is: level 0 requires an exact match, level 1 (the default) allows the TLD to differ, and level 2 allows different aliases for the same domain. Emails that are DKIM signed by senders listed in fns_ignore_dkim are skipped. When a spoof is detected, tags such as _FNSFNAMEADDR_ hold the detected values (see the Tags section below).
The FromNameSpoof plugin adds the following tags that are available for use in reports, header fields, and other plugins:
| Tag | Description |
|---|---|
_FNSFNAMEADDR_ |
Detected spoof address from From:name header |
_FNSFNAMEDOMAIN_ |
Detected spoof domain from From:name header |
_FNSFNAMEOWNER_ |
Detected spoof owner from From:name header |
_FNSFADDRADDR_ |
Actual From:addr address |
_FNSFADDRDOMAIN_ |
Actual From:addr domain |
_FNSFADDROWNER_ |
Actual From:addr detected owner |
| Area | Rule name | Description | Default scores |
|---|---|---|---|
| meta | FROMNAME_SPOOF |
From:name does not match From:address | 1.0 |
| meta | FROMNAME_SPOOF_EQUALS_TO |
From:name is spoof to look like To: address | 1.2 |
| meta | FROMNAME_SPOOF_FREEMAIL |
From:name spoof and Freemail From:address | 2.0 |