we are receiving FAKE messages [spam & malware] having fake "From:" field stating our domain, but header lines show that First 'received-from is from some unknown foreign ip address originating, definitely not our domain
question:
when receiving mails [through exchange] if From: domain is FRIENDLY [white-list] then check that FIRST received-from MUST also belong to FRIENDLY [white-list] ip addresses
this white-list is our internal list, wants to check this condition with powershell on server side
is it possible?
or some other advice?
thnx in advance