Same here, but I found some interesting facts about outlook spam, they have 4 common marks that can be used to catch them with Spamassassin.
The following rules block all outlook spam, but will also block some legitimate emails that use "undisclosed recipients". Not a big deal for me and my networks, but be aware of this limitation. To use, simply copy paste the rules under /etc/mail/spamassassin/outlook.cf (which is the correct location for Enterprise Linix distros like Alma, Rocky and Oracle). Here are the rules: header __SPAM_DOMAIN_OUTLOO1 Received =~ /outbound\.protection\.outlook\.com/i header __SPAM_DOMAIN_OUTLOO2 From =~ /\@(?:outlook|hotmail)\.com\b/i header __SPAM_DOMAIN_OUTLOO3 To =~ /undisclosed/i header __SPAM_DOMAIN_OUTLOO4 To =~ /recipients/i header __SPAM_DOMAIN_OUTLOO5 exists:To meta SPAM_DOMAIN_OUTLOO6 (__SPAM_DOMAIN_OUTLOO1 && (__SPAM_DOMAIN_OUTLOO3 || __SPAM_DOMAIN_OUTLOO4)) score SPAM_DOMAIN_OUTLOO6 15.0 describe SPAM_DOMAIN_OUTLOO6 Outlook spam with undisclosed recipients (outloo) meta SPAM_DOMAIN_OUTLOO7 (__SPAM_DOMAIN_OUTLOO2 && MISSING_HEADERS) score SPAM_DOMAIN_OUTLOO7 15.0 describe SPAM_DOMAIN_OUTLOO7 Outlook spam with missing headers (outloo) meta SPAM_DOMAIN_OUTLOO8 (__SPAM_DOMAIN_OUTLOO1 && __SPAM_DOMAIN_OUTLOO2 && __TO_EQ_FROM_DOM) score SPAM_DOMAIN_OUTLOO8 15.0 describe SPAM_DOMAIN_OUTLOO8 Outlook spam, same From/To (outloo) meta SPAM_DOMAIN_OUTLOO9 (__SPAM_DOMAIN_OUTLOO1 && MISSING_HEADERS && !__SPAM_DOMAIN_OUTLOO5) score SPAM_DOMAIN_OUTLOO9 15.0 describe SPAM_DOMAIN_OUTLOO9 Outlook spam with missing headers, missing To (outloo) On Sun, 7 Jan 2024 10:17:56 -0500 John Hill via Postfix-users <postfix-users@postfix.org> wrote: > First I am really amazed at the amount of support, that's not true > everywhere. I also like the tone of the posts, very respectful. > > I have 3.7.9 and all the settings. > > Outlook protection is slamming me, 6 to 10 worthless emails every day. > glad they don't make condoms. > > I have sent everyone with source back to ab...@outlook.com. They always > automatically thank me. > > I can't block outlook, so I gave up and block all onmicrosoft emails. > > I'll see how that goes. > > --john > > _______________________________________________ > Postfix-users mailing list -- postfix-users@postfix.org > To unsubscribe send an email to postfix-users-le...@postfix.org _______________________________________________ Postfix-users mailing list -- postfix-users@postfix.org To unsubscribe send an email to postfix-users-le...@postfix.org