On 12 Oct 2004, at 21:09, Brian Grossman wrote:

On Mon, 11 Oct 2004 20:50:12 +0100
Matt Sergeant <[EMAIL PROTECTED]> wrote:

My top tips:

Block anything without a Message-ID header.
Block anything without any Received headers.
Block anything found in CBL, SBL and SORBS.
Block anything HELOing with a string matching \d+[\.-]\d+

Have you had difficulty with HELOes like 1-800-flowers.com or mail9.23skidoo.com?

This is a small domain with two users, so no. I don't block that for MessageLabs - I have a much more complex (and thus administration intensive) set of HELO blocking installed. If I were a large scale mail admin I would probably see FPs with that block but add some more punctuation and digits in there (e.g. \d+[\.-]\d+[\.-]\d+) and you'll eliminate FPs (except for google.com, which uses a custom and rather annoying outbound SMTP server).


Block anything marked "bulk" in DCC.

Is there a qpsmtpd DCC plugin floating around anywhere?

Here's what I use:

sub check_dcc {
  my ($self, $transaction) = @_;

  $self->log(1, "Checking DCC");
  $transaction->body_resetpos;

  my $dcc = Net::DCCIf->new() or return DECLINED;
  my @recipients = map { $_->address } $transaction->recipients;
  $dcc->connect(
        env_from => $transaction->sender->address,
        env_to => [EMAIL PROTECTED],
        clnt_addr => $self->connection->remote_ip,
        clnt_name => $self->connection->remote_host,
        helo => $self->connection->hello,
        );
  $dcc->send("header", $transaction->header->as_string);
  $dcc->send("header", "\r\n");
  while (my $line = $transaction->body_getline) {
    $dcc->send("body", $line);
  }
  my ($results, %mapping) = $dcc->get_results();
  my $output = $dcc->get_output();
  my ($key, $value) = split(/:/, $output, 2);
  $transaction->header->add('X-DCC-Result', $results);
  $transaction->header->add('X-DCC-Metrics', $value);
  $self->log(1, "DCC: $results");
  $self->log(1, "DCC ($_): $mapping{$_}") for keys %mapping;
  $self->log(1, "DCC Metrics: $value");
  return DENY, "DCC" if $results =~ /Reject/;
  return DECLINED;
}

I guess we should add something like that to the distro, though it's VERY hacky and I'd rather something more sane were added.

Matt.



Reply via email to