Using filtering, headers test should work. This is a snippet of mine:
I call this, risk-mail.txt. I penalize domains for which have sent spam.
Thus, if they fail other tests, enough points are scored and they get hit.
If an actual user on these networks tries to send normal email, the will get
a light score and thus will be delivered. This is mainly useful for
spambots or zombies.
SKIPIFWEIGHT 16
STOPATFIRSTHIT
REVDNS 3 CONTAINS bermudy.net
REVDNS 3 CONTAINS .cable.mindspring.com
REVDNS 10 CONTAINS hygscarves.com
REVDNS 5 CONTAINS moneynowllc.com
REVDNS 5 CONTAINS .btnaccess.net
So, if you had a list of ips... you would add these lines:
HEADERS 5 CONTAINS xxx.xxx.xxx.xxx
where xxx = ip address.
It is my understanding the REVDNS check does not test any other IP than the
server that handed off email to your server. v 1.82 that is...
I tested this by adding my workstation IP to an IPFILE and it didn't fail
the test, although it is listed in the headers. Only the IP of the foreign
server connecting to the declude server will be checked.
Thus, the example filter file above is your solution. It will catch that
unwanted IP anywhere in the headers no matter how many servers they relay
through.
Travis
----- Original Message -----
From: "Nick Hayer" <[EMAIL PROTECTED]>
To: <[email protected]>
Sent: Tuesday, November 08, 2005 9:12 AM
Subject: Re: [Declude.JunkMail] ipfile
Travis Sullivan wrote:
It is my understanding that it's just the sending IP, the last server
that connects to your server.
So can there be a way to filter [detect] on the other ip's contained in
the route? for example:
Host > MTA(1) > MTA(2) > MTA(3).
Now MTA(2) is a forwarder and I would like to know that. Can that info be
captured? I've tested it with a HEADERS CONTAINS and an ipfile without
success. Or so it seems :) Maybe there is %hop% variable?
Thanks!
-Nick
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
