.\" Automatically generated by Pod::Man 4.10 (Pod::Simple 3.35)
.\"
.\" Standard preamble:
.\" ========================================================================
.de Sp \" Vertical space (when we can't use .PP)
.if t .sp .5v
.if n .sp
..
.de Vb \" Begin verbatim text
.ft CW
.nf
.ne \\$1
..
.de Ve \" End verbatim text
.ft R
.fi
..
.\" Set up some character translations and predefined strings.  \*(-- will
.\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left
.\" double quote, and \*(R" will give a right double quote.  \*(C+ will
.\" give a nicer C++.  Capital omega is used to do unbreakable dashes and
.\" therefore won't be available.  \*(C` and \*(C' expand to `' in nroff,
.\" nothing in troff, for use with C<>.
.tr \(*W-
.ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p'
.ie n \{\
.    ds -- \(*W-
.    ds PI pi
.    if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch
.    if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\"  diablo 12 pitch
.    ds L" ""
.    ds R" ""
.    ds C` ""
.    ds C' ""
'br\}
.el\{\
.    ds -- \|\(em\|
.    ds PI \(*p
.    ds L" ``
.    ds R" ''
.    ds C`
.    ds C'
'br\}
.\"
.\" Escape single quotes in literal strings from groff's Unicode transform.
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\"
.\" If the F register is >0, we'll generate index entries on stderr for
.\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index
.\" entries marked with X<> in POD.  Of course, you'll have to process the
.\" output yourself in some meaningful fashion.
.\"
.\" Avoid warning from groff about undefined register 'F'.
.de IX
..
.nr rF 0
.if \n(.g .if rF .nr rF 1
.if (\n(rF:(\n(.g==0)) \{\
.    if \nF \{\
.        de IX
.        tm Index:\\$1\t\\n%\t"\\$2"
..
.        if !\nF==2 \{\
.            nr % 0
.            nr F 2
.        \}
.    \}
.\}
.rr rF
.\" ========================================================================
.\"
.IX Title "Mail::SpamAssassin::Plugin::FromNameSpoof 3pm"
.TH Mail::SpamAssassin::Plugin::FromNameSpoof 3pm "2020-01-31" "perl v5.28.1" "User Contributed Perl Documentation"
.\" For nroff, turn off justification.  Always turn off hyphenation; it makes
.\" way too many mistakes in technical documents.
.if n .ad l
.nh
.SH "NAME"
FromNameSpoof \- perform various tests to detect spoof attempts using the From header name section
.SH "SYNOPSIS"
.IX Header "SYNOPSIS"
loadplugin    Mail::SpamAssassin::Plugin::FromNameSpoof
.PP
.Vb 2
\& # Does the From:name look like it contains an email address
\& header   _\|_PLUGIN_FROMNAME_EMAIL  eval:check_fromname_contains_email()
\&
\& # Is the From:name different to the From:addr header
\& header   _\|_PLUGIN_FROMNAME_DIFFERENT  eval:check_fromname_different()
\&
\& # From:name and From:addr owners differ
\& header   _\|_PLUGIN_FROMNAME_OWNERS_DIFFER  eval:check_fromname_owners_differ()
\&
\& # From:name domain differs to from header
\& header   _\|_PLUGIN_FROMNAME_DOMAIN_DIFFER  eval:check_fromname_domain_differ()
\&
\& # From:name and From:address don\*(Aqt match and owners differ
\& header   _\|_PLUGIN_FROMNAME_SPOOF  eval:check_fromname_spoof()
\&  
\& # From:name address matches To:address
\& header _\|_PLUGIN_FROMNAME_EQUALS_TO  eval:check_fromname_equals_to()
.Ve
.SH "DESCRIPTION"
.IX Header "DESCRIPTION"
Perform various tests against From:name header to detect spoofing. Steps in place to 
ensure minimal FPs.
.SH "CONFIGURATION"
.IX Header "CONFIGURATION"
The plugin allows you to skip emails that have been \s-1DKIM\s0 signed by specific senders:
.PP
.Vb 1
\& fns_ignore_dkim googlegroups.com
.Ve
.PP
FromNameSpoof allows for a configurable closeness when matching the From:addr and From:name,
the closeness can be adjusted with:
.PP
.Vb 1
\& fns_extrachars 50
.Ve
.PP
\&\fBNote\fR that FromNameSpoof detects the \*(L"owner\*(R" of a domain by the following search:
.PP
.Vb 1
\& <owner>.<tld>
.Ve
.PP
By default FromNameSpoof will ignore the \s-1TLD\s0 when testing if From:addr is spoofed.
Default 1
.PP
.Vb 1
\&  fns_check 1
.Ve
.PP
Check levels:
.PP
.Vb 3
\& 0 \- Strict checking of From:name != From:addr
\& 1 \- Allow for different tlds
\& 2 \- Allow for different aliases but same domain
.Ve
.SH "TAGS"
.IX Header "TAGS"
The following tags are added to the set if a spoof is detected. They are available for 
use in reports, header fields, other plugins, etc.:
.PP
.Vb 2
\&  _FNSFNAMEADDR_
\&    Detected spoof address from From:name header
\&
\&  _FNSFNAMEDOMAIN_
\&    Detected spoof domain from From:name header
\&
\&  _FNSFNAMEOWNER_
\&    Detected spoof owner from From:name header
\&
\&  _FNSFADDRADDR_
\&    Actual From:addr address
\&
\&  _FNSFADDRDOMAIN_ 
\&    Actual From:addr domain
\&
\&  _FNSFADDROWNER_
\&    Actual From:addr detected owner
.Ve
.SH "EXAMPLE"
.IX Header "EXAMPLE"
header   _\|_PLUGIN_FROMNAME_SPOOF \fBeval:check_fromname_spoof()\fR
header   _\|_PLUGIN_FROMNAME_EQUALS_TO \fBeval:check_fromname_equals_to()\fR
.PP
meta     \s-1FROMNAME_SPOOF_EQUALS_TO\s0  (_\|_PLUGIN_FROMNAME_SPOOF && _\|_PLUGIN_FROMNAME_EQUALS_TO)
describe \s-1FROMNAME_SPOOF_EQUALS_TO\s0 From:name is spoof to look like To: address
score    \s-1FROMNAME_SPOOF_EQUALS_TO 1.2\s0