spamassassin-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From mouss <mo...@ml.netoyen.net>
Subject Re: Alternative to Postfix header_checks?
Date Fri, 09 Jan 2009 22:00:28 GMT
Gerald Turner a écrit :
> Hello, I have been using SpamAssassin integrated with Postfix via spampd
> SMTP proxy and I have the following header_checks file:
> 
>   /^X-Spam-Level: \*{8,}/ DISCARD Spam score 8+
>   /^X-Spam-Level: \*{4,}/ REJECT Spam score 4+
> 
> There are cases where I'd rather DISCARD the low score mail (>= 4, < 8)
> than REJECT, for instance:
> 
>    When the mail contains mailing-list headers - some mailing lists
>    unsubscribe after too many bounces, particularly Debian with
>    open/unmoderated lists.
> 
>    When the mail was sent to a quasi-spamtrap address - I'm aliased on a
>    few hosts with webmaster@example.com type addresses, some of which
>    will generate bounce warnings to mailer-daemon who is aliased to
>    several people, evil!
> 
> Unfortunately Postfix header_checks can only process one header at a
> time, there's no way to compound conditions of multiple headers.  I've
> searched and can't seem to come up with any possibility of configuring
> Postfix to conditionally discard rather than bounce.  I'm on the verge
> of customizing an example Perl milter to do the job, but it seems like
> something that should be built-in to either Postfix, spampd, or perhaps
> amavisd-new - any suggestions?
> 

first, add an SA rule to detect mailing lists. for example

header H_FROM_ML ...
score H_FROM_ML 0.01

(actually, you will need multiple rules, then combine them with a meta).

then your header checks would become

/^X-Spam-Status: Yes, score=([8-9]|\d{2}).*H_FROM_ML/	....

some notes:

- unless you are calling SA during the smtp transaction, you should not
reject mail (ie after it was queued by postfix)

- discarding mail is risky.

- spammers can forge list headers...

- There are other cases when you don't want to reject (mail to
abuse@example.com, ... etc).



Mime
View raw message