Mail::...meSpoof(3pm)

💖 Mail::...meSpoof(3pm) — User Contributed Perl Documentation 💖

okay bestie, welcome to Mail::...meSpoof(3pm), a lil Perl manpage that's basically a detective for the From: header 🕵️‍♀️✨

---

✨ NAME ✨

FromNameSpoof — she runs a whole bunch of tests to sniff out spoofing attempts that hide in the From header's name section. no cap, that's the whole job 💅

---

🎀 SYNOPSIS 🎀

loadplugin    Mail::SpamAssassin::Plugin::FromNameSpoof

 # From:name and From:addr do not match, matching depends on C<fns_check> setting
 header  __PLUGIN_FROMNAME_SPOOF  eval:check_fromname_spoof()

 # From:name and From:addr do not match (same as above rule and C<fns_check 0>)
 header  __PLUGIN_FROMNAME_DIFFERENT  eval:check_fromname_different()

 # From:name and From:addr domains differ
 header  __PLUGIN_FROMNAME_DOMAIN_DIFFER  eval:check_fromname_domain_differ()

 # From:name looks like it contains an email address (not same as From:addr)
 header  __PLUGIN_FROMNAME_EMAIL  eval:check_fromname_contains_email()

 # From:name matches any To:addr
 header  __PLUGIN_FROMNAME_EQUALS_TO  eval:check_fromname_equals_to()

 # From:name and From:addr owners differ
 header  __PLUGIN_FROMNAME_OWNERS_DIFFER  eval:check_fromname_owners_differ()

 # From:name matches Reply-To:addr
 header  __PLUGIN_FROMNAME_EQUALS_REPLYTO  eval:check_fromname_equals_replyto()

---

🌸 DESCRIPTION 🌸

So what she does is run a bunch of different tests against the From:name header to catch spoofing 🕵️‍♀️ and she takes steps in place to make sure the false positives stay minimal. considerate queen behavior fr fr 💖

---

💅 CONFIGURATION 💅

the plugin lets you ghost emails that have already been DKIM signed by specific senders:

fns_ignore_dkim googlegroups.com

FromNameSpoof also lets you tune how close the match between From:addr and From:name has to be — you adjust that closeness with:

fns_extrachars 50

heads up bestie: FromNameSpoof figures out the "owner" of a domain by doing this search: <owner>.<tld>

by default, FromNameSpoof ignores the TLD when it's comparing addresses:

fns_check 1

and here are the check levels, periodt:

• 0 — strict checking of From:name != From:addr
• 1 — allow for different TLDs
• 2 — allow for different aliases but same domain

"Owner" info can also be mapped as aliases with fns_add_addrlist. for example, if you wanna treat googlemail.com as gmail:

fns_add_addrlist (gmail) *@googlemail.com

---

🦋 TAGS 🦋

when a spoof gets detected, these tags get added to the set. they're available for use in reports, header fields, other plugins, etc. so go off 👑

• _FNSFNAMEADDR_
  • the detected spoof address, taken from the From:name header
• _FNSFNAMEDOMAIN_
  • the detected spoof domain, taken from the From:name header
• _FNSFNAMEOWNER_
  • the detected spoof owner, taken from the From:name header
• _FNSFADDRADDR_
  • the actual From:addr address
• _FNSFADDRDOMAIN_
  • the actual From:addr domain
• _FNSFADDROWNER_
  • the actual From:addr owner

---

🌈 EXAMPLE 🌈

 header  __PLUGIN_FROMNAME_SPOOF  eval:check_fromname_spoof()
 header  __PLUGIN_FROMNAME_EQUALS_TO  eval:check_fromname_equals_to()
 meta     FROMNAME_SPOOF_EQUALS_TO (__PLUGIN_FROMNAME_SPOOF && __PLUGIN_FROMNAME_EQUALS_TO)
 describe FROMNAME_SPOOF_EQUALS_TO From:name is spoof to look like To: address
 score    FROMNAME_SPOOF_EQUALS_TO 1.2

---

and that's the whole page, bestie 🫶 this icon of a manpage came from perl v5.40.1, dated 2026-07-23, and it lives under the name Mail::...meSpoof(3pm). slay, go forth and catch those spoofers 💖✨🎀