On 1/04/2016 10:22 PM, Russell Coker via luv-main wrote:
From: "postmaster@coker.com.au" <ich@trimas.com.au>
Above is the From field of a spam that recently arrived in my inbox, the Return-Path and Message-ID refer to trimas.com.au so it didn't hit any SPF checks.
Is there a good way of stopping such spam with Postfix and SpamAssassin?
Not likely, email is so broken in some areas, backscatter is one of them; backscatter caused by incorrect SPF handling. Above, the "postmast..." part is just the /pretty/ name, it isn't the real from address; still the trimas.com.au domain has no SPF record for validation anyway.
I wrote some milter code to stop this for a client, the code was a little hacky and even if I had approval to reuse it the amount of work involved would vastly exceed the amount of time it takes to just delete such mail.
You will be fighting a never ending battle. Cheers AndrewM