Hi,
On 12/17/20 6:05 PM, Matt wrote:
Is there a way with spamassassin local.conf to add a higher score
based on source ip address or subnet? Basically the last IP in
"Received:" header.
bad_subnet_add_20_points: 192.168.240.0/24
Raising the score if that IP appeared anywhere in headers or body
might work too.
Yes, but if you're effectively going to create a "poison pill" rule
where any mail from a particular network is quarantined, you might be
better of doing this at the firewall or in postfix directly and just
rejecting it outright.
header __BAD_IP_RCVD Received =~ /192\.168\.240\.\d{1,3}/
body __BAD_IP_BODY /192\.168\.240\.\d{1,3}/
rawbody __BAD_IP_RAWBODY /192\.168\.240\.\d{1,3}/
meta MY_BAD_SENDER __BAD_IP_RCVD || __BAD_IP_BODY || __BAD_IP_RAWBODY
score MY_BAD_SENDER 20
describe MY_BAD_SENDER Contains bad IP
Regards,
Dave
