This is great, but still a lot of "nobody" spam is being sent, e.g. from a simple php newsletter type script, that is until we find it and delete it.
Here's the main header in such a script that goes out with the email:
Received: from nobody by servername.ourdomain.com with local (Exim 4.52)
So how can I tweak this:
nobody@lsearch;/etc/localdomains "${if !eq {$header_From:}{}{$header_sender:$header_From:}fail}" Fs
To also catch this:
Received: from nobody by servername.ourdomain.com with local (Exim 4.52)
By the way, the actual from header is usually something like this:
From: PayPal Inc. <
[email protected]>
-----
Here's my guess, but I hesitate to try this in fear of breaking exim:
"from nobody" "${if !eq {$header_Received:}{}{$header_sender:$header_Received:}fail}" Fs
Or would I need to use something like:
from+nobody "${if !eq {$header_Received:}{}{$header_sender:$header_Received:}fail}" Fs