Content filter for not matching headers

[zheka_pefti]

Hello,

Can anyone give me an idea or an advice on how to create a content filter within email security to mark or quarantine emails with non matching from headers. For example, I want to identify emails where I see these not matching headers:

Message 4004646 Domains for which SDR is requested: reverse DNS host: host60.mambonetcom.com, helo: host60.mambonetcom.com, env-from: dominionlendingnews.ca, header_from: hotmail.com, reply_to: hotmail.com

As you see, env-from is different from header_from. Also, I don't mind comparing it with reply_to as well

[zheka_pefti]

Anyone, anything ? .....

[marc.luescherFRE]

I spent weeks getting this to work and have written about it on my blog.

My current solution is not working 100% but gives you at least some alerts.

[svgeorgi]

There are few enhancement requests already filed for the same:
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvb97836

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCum25300

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCzv12332

Unfortunately, none of them have been implemented yet.

You can subscribe for them in case got implemented actually.