---
title: FromNameSpoof
url: 'https://docs.danami.com/warden/user-guide/antispam-plugins/fromnamespoof'
markdown: 'https://docs.danami.com/warden/user-guide/antispam-plugins/fromnamespoof.md'
date: '2026-10-02'
description: 'This plugin was introduced in Spamassassin 3.4.2. This plugin performs various tests against the display name in the From: header (From:name) to detect spoofing, with steps in place to keep false positives to a minimum. How it works The plugin compares the From:name display name against t…'
taxonomy:
  category:
    - docs
  tag:
    - fromnamespoof
---

[](#)  [ Basics ](https://docs.danami.com/warden/)     [ User Guide ](https://docs.danami.com/warden/user-guide)     [ Anti-spam Plugins ](https://docs.danami.com/warden/user-guide/antispam-plugins)      FromNameSpoof    

# FromNameSpoof

> > > > > This plugin was introduced in Spamassassin 3.4.2.

This plugin performs various tests against the display name in the From: header (From:name) to detect spoofing, with steps in place to keep false positives to a minimum.

## How it works

The plugin compares the From:name display name against the actual From: address, and in separate tests against the To: and Reply-To: addresses, to detect spoofing. The `fns_check` setting controls how strict the From:name/From:addr comparison is: level 0 requires an exact match, level 1 (the default) allows the TLD to differ, and level 2 allows different aliases for the same domain. Emails that are DKIM signed by senders listed in `fns_ignore_dkim` are skipped. When a spoof is detected, tags such as `_FNSFNAMEADDR_` hold the detected values (see the Tags section below).

## Tags

The FromNameSpoof plugin adds the following tags that are available for use in reports, header fields, and other plugins:

| Tag | Description |
|---|---|
| `_FNSFNAMEADDR_` | Detected spoof address from From:name header |
| `_FNSFNAMEDOMAIN_` | Detected spoof domain from From:name header |
| `_FNSFNAMEOWNER_` | Detected spoof owner from From:name header |
| `_FNSFADDRADDR_` | Actual From:addr address |
| `_FNSFADDRDOMAIN_` | Actual From:addr domain |
| `_FNSFADDROWNER_` | Actual From:addr detected owner |

## Rules

| Area | Rule name | Description | Default scores |
|---|---|---|---|
| meta | `FROMNAME_SPOOF` | From:name does not match From:address | 1.0 |
| meta | `FROMNAME_SPOOF_EQUALS_TO` | From:name is spoof to look like To: address | 1.2 |
| meta | `FROMNAME_SPOOF_FREEMAIL` | From:name spoof and Freemail From:address | 2.0 |

## Related Pages

- [FromNameSpoof Settings](https://docs.danami.com/warden/settings/antispam/plugin-settings/fromnamespoof "FromNameSpoof Settings")

 [](https://docs.danami.com/warden/command-line-interface/antispam/antispam-plugin-fromenamespoof)

---

## Navigation

- Parent: [Anti-spam Plugins](https://docs.danami.com/warden/user-guide/antispam-plugins.md)
- Previous: [FreeMail](https://docs.danami.com/warden/user-guide/antispam-plugins/freemail.md)
- Next: [HashBL](https://docs.danami.com/warden/user-guide/antispam-plugins/hashbl.md)