We have an info@ourdomain.tld address which is setup as an alias in MAIB’s admin panel to forward to a couple of our users.
These users have sieve filters to put these emails into “Info” folders so they know right away that it’s come to this general address, and is frankly probably spam, so they should be careful with it. However, recently we have been getting more and more spam especially (if not always) where this address is BCCed and the only address in the “to” field is one of the spammer’s own.
This is annoying because not only is it spam (which I have made peace with is something we will just have to tolerate), but it’s dodging the filters I setup for these users, because info@ourcompany.tld isn’t appearing anywhere in the headers, except as something like this
Received: from жкю.064.рус (жкю.064.рус [31.28.27.180])
by [our mail server] (Postfix) with ESMTP id 4D3F9A56
for info@ourdomain.tld; Tue, 17 Dec 2024 14:57:19 -0800 (PST)
Received: from holcis.coupons (solasom.shop [109.107.161.33])
by жкю.064.рус (Postfix) with ESMTPA id 61CBD24F0B;
Wed, 18 Dec 2024 00:38:03 +0200 (EET)
I tried (though it’s not ideal for other reasons perhaps) creating a filter that puts all mail into their spam folders and then a second filter that would put it back into their inboxs if they were in the header’s “to” or “cced” fields, followed by their other filters, but this didn’t work either because it just created copies for some reason in both folders. Even if this did work, it’s probably not the professional way to do it, as they would then not get legitimate emails that they were BCCed in, so I didn’t spend too much time trying to understand what was going wrong.
I am wondering, has anyone had any success in creating a sieve filter to catch similar situations (or any other ideas most welcome)?