On 12 Oct 2004, at 21:09, Brian Grossman wrote:
On Mon, 11 Oct 2004 20:50:12 +0100 Matt Sergeant <[EMAIL PROTECTED]> wrote:
My top tips:
Block anything without a Message-ID header. Block anything without any Received headers. Block anything found in CBL, SBL and SORBS. Block anything HELOing with a string matching \d+[\.-]\d+
Have you had difficulty with HELOes like 1-800-flowers.com or mail9.23skidoo.com?
This is a small domain with two users, so no. I don't block that for MessageLabs - I have a much more complex (and thus administration intensive) set of HELO blocking installed. If I were a large scale mail admin I would probably see FPs with that block but add some more punctuation and digits in there (e.g. \d+[\.-]\d+[\.-]\d+) and you'll eliminate FPs (except for google.com, which uses a custom and rather annoying outbound SMTP server).
Block anything marked "bulk" in DCC.
Is there a qpsmtpd DCC plugin floating around anywhere?
Here's what I use:
sub check_dcc {
my ($self, $transaction) = @_;$self->log(1, "Checking DCC"); $transaction->body_resetpos;
my $dcc = Net::DCCIf->new() or return DECLINED;
my @recipients = map { $_->address } $transaction->recipients;
$dcc->connect(
env_from => $transaction->sender->address,
env_to => [EMAIL PROTECTED],
clnt_addr => $self->connection->remote_ip,
clnt_name => $self->connection->remote_host,
helo => $self->connection->hello,
);
$dcc->send("header", $transaction->header->as_string);
$dcc->send("header", "\r\n");
while (my $line = $transaction->body_getline) {
$dcc->send("body", $line);
}
my ($results, %mapping) = $dcc->get_results();
my $output = $dcc->get_output();
my ($key, $value) = split(/:/, $output, 2);
$transaction->header->add('X-DCC-Result', $results);
$transaction->header->add('X-DCC-Metrics', $value);
$self->log(1, "DCC: $results");
$self->log(1, "DCC ($_): $mapping{$_}") for keys %mapping;
$self->log(1, "DCC Metrics: $value");
return DENY, "DCC" if $results =~ /Reject/;
return DECLINED;
}I guess we should add something like that to the distro, though it's VERY hacky and I'd rather something more sane were added.
Matt.
