Create a filter of your choice (e.g. 4TLD) and call it from the Declude global.cfg the filter should contain the following line/s.
MAILFROM 100 PCRE (?i:\.[a-z]{4,}$) REVDNS 100 PCRE (?i:\.[a-z]{4,}$) HELO 100 PCRE (?i:\.[a-z]{4,}$) If you want to delete the messages you could add the following to your $default$.junkmail 4TLD DELETE David Barker Mail's Best Friend Email : <mailto:david.bar...@mailsbestfriend.com> david.bar...@mailsbestfriend.com Web : <http://www.mailsbestfriend.com/> www.mailsbestfriend.com Office : 866.919.2075 From: community@mailsbestfriend.com [mailto:community@mailsbestfriend.com] On Behalf Of Noah Sent: Thursday, August 20, 2015 1:58 PM To: community@mailsbestfriend.com Subject: [MBF] Re: .review We run SM 13 with Declude/Sniffer - what would be the best filter file to add it to? Is it possible to create a rule that would dump any mail from any TLD over 4 characters? Thanks, Noah From: community@mailsbestfriend.com <mailto:community@mailsbestfriend.com> [mailto:community@mailsbestfriend.com] On Behalf Of Markus Gufler | Limitis Sent: Thursday, August 20, 2015 12:25 PM To: community@mailsbestfriend.com <mailto:community@mailsbestfriend.com> Subject: [MBF] AW: .review Just add a line MAILFROM 9999 ENDSWITH .review to one of your existing filter files to push him far above your hold weight. if you really want to block so rough. In the past 7 days I can see exactly 3 messages (out of 336000) coming from .review All of them are clear spam ;-) regards Markus Von: community@mailsbestfriend.com <mailto:community@mailsbestfriend.com> [mailto:community@mailsbestfriend.com] Im Auftrag von Noah Gesendet: Donnerstag, 20. August 2015 18:08 An: community@mailsbestfriend.com <mailto:community@mailsbestfriend.com> Betreff: [MBF] .review How do I go about blocking any mail with a .review address? We have seen a lot of them getting through the filters and they are all spam. Thanks, Noah