Mercurial > dnsbl

annotate dnsbl.conf @ 356:90d433d1382e

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
when extracting header fields, need to preserve the header value since that will be used by subsequent (dcc,spamd,etc) milters
author Carl Byington <carl@five-ten-sg.com>
date Sun, 08 Jan 2017 21:13:01 -0800
parents f4ca91f49cb6
children 1b7a785610f5
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
127
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
1 context main-default {
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
2 // outbound dnsbl filtering to catch our own customers that end up on the sbl
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
3 dnsbl sbl sbl-xbl.spamhaus.org "Mail from %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s";
174
da0c41b9f672 don't whitelist addresses with embedded spaces
carl
parents: 172
diff changeset
4 dnsbl_list sbl;
127
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
5
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
6 // outbound content filtering to prevent our own customers from sending spam
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
7 content on {
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
8 filter sbl-xbl.spamhaus.org "Mail containing %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s";
270
f92f24950bd3 Use mozilla prefix list for tld checking, Enable surbl/uribl/dbl rhs lists
Carl Byington <carl@five-ten-sg.com>
parents: 268
diff changeset
9 uribl multi.surbl.org "Mail containing %s rejected - surbl; see http://www.surbl.org/surbl-analysis?d=%s";
259
be939802c64e add recipient rate limits by email from address or domain
Carl Byington <carl@five-ten-sg.com>
parents: 255
diff changeset
10 #uribl multi.uribl.com "Mail containing %s rejected - uribl; see http://l.uribl.com/?d=%s";
270
f92f24950bd3 Use mozilla prefix list for tld checking, Enable surbl/uribl/dbl rhs lists
Carl Byington <carl@five-ten-sg.com>
parents: 268
diff changeset
11 #uribl dbl.spamhaus.org "Mail containing %s rejected - dbl; see http://www.spamhaus.org/query/domain?domain=%s";
127
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
12 ignore { include "hosts-ignore.conf"; };
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
13 tld { include "tld.conf"; };
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
14 html_tags { include "html-tags.conf"; };
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
15 html_limit on 20 "Mail containing excessive bad html tags rejected";
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
16 html_limit off;
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
17 host_limit on 20 "Mail containing excessive host names rejected";
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
18 host_limit soft 20;
178
d6531c702be3 embedded dcc filtering
carl
parents: 175
diff changeset
19 spamassassin 4;
d6531c702be3 embedded dcc filtering
carl
parents: 175
diff changeset
20 require_match yes;
d6531c702be3 embedded dcc filtering
carl
parents: 175
diff changeset
21 dcc_greylist yes;
d6531c702be3 embedded dcc filtering
carl
parents: 175
diff changeset
22 dcc_bulk_threshold 50;
127
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
23 };
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
24
278
368572c57013 add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents: 270
diff changeset
25 // backscatter prevention - do not send bounces for mail that we accepted but could not forward
127
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
26 // we only send bounces to our own customers
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
27 env_from unknown {
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
28 "<>" black;
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
29 };
136
f4746d8a12a3 add smtp auth rate limits
carl
parents: 127
diff changeset
30
278
368572c57013 add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents: 270
diff changeset
31 // hourly recipient rate limit by smtp auth client id, or unauthenticated mail from address
368572c57013 add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents: 270
diff changeset
32 // hourly unique ip addresses by smtp auth client id, or unauthenticated mail from address
368572c57013 add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents: 270
diff changeset
33 // default hourly rate limit is 30
368572c57013 add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents: 270
diff changeset
34 // daily rate limits are 4 times the hourly limit
368572c57013 add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents: 270
diff changeset
35 // default hourly unique ip addresses is 5
368572c57013 add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents: 270
diff changeset
36 // daily unique ip addresses are 4 times the hourly limit
368572c57013 add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents: 270
diff changeset
37 rate_limit 30 4 5 4 { // default
368572c57013 add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents: 270
diff changeset
38 fred 100 10; // override default limits
368572c57013 add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents: 270
diff changeset
39 joe 10 2; // ""
368572c57013 add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents: 270
diff changeset
40 "sam@somedomain.tld" 500 2;
368572c57013 add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents: 270
diff changeset
41 "@otherdomain.tld" 100 2;
136
f4746d8a12a3 add smtp auth rate limits
carl
parents: 127
diff changeset
42 };
127
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
43 };
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
44
94
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
45 context main {
136
f4746d8a12a3 add smtp auth rate limits
carl
parents: 127
diff changeset
46 dnsbl localp partial.blackholes.five-ten-sg.com "Mail from %s rejected - local; see http://www.five-ten-sg.com/blackhole.php?%s";
94
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
47 dnsbl local blackholes.five-ten-sg.com "Mail from %s rejected - local; see http://www.five-ten-sg.com/blackhole.php?%s";
174
da0c41b9f672 don't whitelist addresses with embedded spaces
carl
parents: 172
diff changeset
48 dnsbl sbl zen.spamhaus.org "Mail from %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s";
94
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
49 dnsbl xbl xbl.spamhaus.org "Mail from %s rejected - xbl; see http://www.spamhaus.org/query/bl?ip=%s";
249
15bf4f68a0b2 Add dnswl support
Carl Byington <carl@five-ten-sg.com>
parents: 233
diff changeset
50 dnswl dnswl.org list.dnswl.org 2;
171
8deb51871b3d fix pre/post scripts in rpm spec file
carl
parents: 168
diff changeset
51 dnsbl_list local sbl;
249
15bf4f68a0b2 Add dnswl support
Carl Byington <carl@five-ten-sg.com>
parents: 233
diff changeset
52 dnswl_list dnswl.org;
268
f941563c2a95 Add require_rdns checking
Carl Byington <carl@five-ten-sg.com>
parents: 263
diff changeset
53 require_rdns yes;
94
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
54
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
55 content on {
322
9f8411f3919c add dkim white/black listing
Carl Byington <carl@five-ten-sg.com>
parents: 321
diff changeset
56 dkim_signer {
330
b5b93a7e1e6d ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents: 322
diff changeset
57 // we could add consumer facing domains like yahoo.com, aol.com, etc
b5b93a7e1e6d ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents: 322
diff changeset
58 // here, IF you really want to accept all the mail from such folks.
b5b93a7e1e6d ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents: 322
diff changeset
59 five-ten-sg.com white;
b5b93a7e1e6d ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents: 322
diff changeset
60 some.spammer black; // reject if signed by them
322
9f8411f3919c add dkim white/black listing
Carl Byington <carl@five-ten-sg.com>
parents: 321
diff changeset
61 };
9f8411f3919c add dkim white/black listing
Carl Byington <carl@five-ten-sg.com>
parents: 321
diff changeset
62
9f8411f3919c add dkim white/black listing
Carl Byington <carl@five-ten-sg.com>
parents: 321
diff changeset
63 dkim_from {
330
b5b93a7e1e6d ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents: 322
diff changeset
64 // cannot really add consumer facing domains like yahoo.com, aol.com, etc
b5b93a7e1e6d ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents: 322
diff changeset
65 // here, since such messages from humans might be sent via mailing lists
b5b93a7e1e6d ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents: 322
diff changeset
66 // that will break the dkim signature. But this works well for commonly
b5b93a7e1e6d ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents: 322
diff changeset
67 // forged bulk senders like ebay and paypal.
b5b93a7e1e6d ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents: 322
diff changeset
68 some.spammer require_signed some.spammer // reject if not signed
b5b93a7e1e6d ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents: 322
diff changeset
69
350
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
70 123greetings.info require_signed 123greetings.info;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
71 aadvantage.email.aa.com require_signed aadvantage.email.aa.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
72 admarketing.yahoo.com require_signed admarketing.yahoo.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
73 adp.com require_signed adp.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
74 alertsp.chase.com require_signed alertsp.chase.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
75 allaboutjazz.com require_signed allaboutjazz.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
76 alpineescrow.net require_signed alpineescrowarrowhead.onmicrosoft.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
77 amazon.com require_signed amazon.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
78 applemusic.com require_signed applemusic.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
79 billpay.bankofamerica.com require_signed billpay.bankofamerica.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
80 booking.com require_signed sg.booking.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
81 cafepress.com require_signed cafepressinc.onmicrosoft.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
82 checkin.email.aa.com require_signed checkin.email.aa.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
83 connect.wellsfargoemail.com require_signed connect.wellsfargoemail.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
84 craigslist.org require_signed craigslist.org;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
85 dailykos.com require_signed sg.actionnetwork.org;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
86 daytimer.com require_signed daytimer.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
87 deals.priceline.com require_signed deals.priceline.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
88 dhl.com require_signed dhl.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
89 dropbox.com require_signed dropbox.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
90 dvd.com require_signed dvd.com
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
91 e.bevmo.com require_signed e.bevmo.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
92 e.bloomingdales.com require_signed e.bloomingdales.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
93 e.business.officedepot.com require_signed e.business.officedepot.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
94 e.shutterfly.com require_signed e.shutterfly.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
95 e.statefarm.com require_signed e.statefarm.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
96 e1.llbean.com require_signed e1.llbean.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
97 ealerts.bankofamerica.com require_signed ealerts.bankofamerica.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
98 easy.staples.com require_signed easy.staples.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
99 ebay.com require_signed ebay.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
100 ecommail.walgreens.com require_signed ecommail.walgreens.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
101 email.aa.com require_signed email.aa.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
102 email.aegeanair.com require_signed email.aegeanair.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
103 email.chase.com require_signed email.chase.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
104 email.consumerreports.org require_signed email.consumerreports.org;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
105 email.dowjones.com require_signed email.dowjones.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
106 email.homedepot.com require_signed email.homedepot.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
107 email.jetblue.com require_signed email.jetblue.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
108 email.ticketmaster.com require_signed email.ticketmaster.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
109 email.travelzoo.com require_signed email.travelzoo.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
110 email.wetransfer.com require_signed email.wetransfer.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
111 email.zazzle.com require_signed email.zazzle.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
112 email.zionlodge.com require_signed email.zionlodge.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
113 emails.cafepress.com require_signed cafepress.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
114 et.uber.com require_signed et.uber.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
115 facebookmail.com require_signed facebookmail.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
116 fedex.com require_signed fedex.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
117 harryanddavid-email.com require_signed harryanddavid-email.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
118 healthcare.gov require_signed healthcare.gov;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
119 imail.register.com require_signed imail.register.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
120 info1.networksolutions.com require_signed info1.networksolutions.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
121 insideapple.apple.com require_signed insideapple.apple.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
122 intuit.com require_signed intuit.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
123 lakearrowheadchamber.com require_signed lakearrowhead.ccsend.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
124 lehighvalleychamber.org require_signed lehighvalleychamber.ccsend.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
125 libertymutual.com require_signed libertymutual.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
126 linkedin.com require_signed linkedin.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
127 luv.southwest.com require_signed luv.southwest.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
128 mail.sling.com require_signed mail.sling.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
129 mail.zillow.com require_signed mail.zillow.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
130 mailer.box.com require_signed box.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
131 midjerseychamber.org require_signed midjerseychamber.ccsend.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
132 monster.com require_signed monster.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
133 my.orbitz.com require_signed my.orbitz.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
134 mystubhub.com require_signed mystubhub.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
135 na.email.aa.com require_signed na.email.aa.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
136 new.itunes.com require_signed new.itunes.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
137 news.united.com require_signed news.united.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
138 nextdayflyers.com require_signed nextdayflyers.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
139 notices.rei.com require_signed notices.rei.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
140 openemail.americanexpress.com require_signed openemail.americanexpress.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
141 orders.staples.com signed_white orders.staples.com; // some unsigned mail via protection.outlook.com
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
142 paychex.com require_signed paychex.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
143 paypal.com require_signed paypal.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
144 public.govdelivery.com require_signed public.govdelivery.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
145 r.groupon.com require_signed r.groupon.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
146 reply1.ebay.com require_signed reply1.ebay.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
147 response.nfcu.org require_signed response.nfcu.org;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
148 service.capitalone.com require_signed capitalone.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
149 service.checkout.visa.com require_signed service.checkout.visa.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
150 sg.booking.com require_signed sg.booking.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
151 subscriptions.ssa.gov require_signed subscriptions.ssa.gov;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
152 support.facebook.com require_signed support.facebook.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
153 support.zappos.com require_signed zappos.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
154 ticketfly.com require_signed ticketfly.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
155 twitter.com require_signed twitter.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
156 unionbank.com require_signed unionbank.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
157 ups.com require_signed ups.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
158 welcome.aexp.com require_signed welcome.aexp.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
159 wellsfargo.com require_signed wellsfargo.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
160 wetransfer.com require_signed email.wetransfer.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
161 zappos.com require_signed zappos.com;
322
9f8411f3919c add dkim white/black listing
Carl Byington <carl@five-ten-sg.com>
parents: 321
diff changeset
162 };
94
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
163 filter sbl-xbl.spamhaus.org "Mail containing %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s";
278
368572c57013 add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents: 270
diff changeset
164 uribl multi.surbl.org "Mail containing %s rejected - surbl; see http://www.surbl.org/surbl-analysis?d=%s";
259
be939802c64e add recipient rate limits by email from address or domain
Carl Byington <carl@five-ten-sg.com>
parents: 255
diff changeset
165 #uribl multi.uribl.com "Mail containing %s rejected - uribl; see http://l.uribl.com/?d=%s";
278
368572c57013 add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents: 270
diff changeset
166 #uribl dbl.spamhaus.org "Mail containing %s rejected - dbl; see http://www.spamhaus.org/query/domain?domain=%s";
94
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
167 ignore { include "hosts-ignore.conf"; };
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
168 tld { include "tld.conf"; };
119
d9d2f8699621 uribl patch from Jeff Evans <jeffe@tricab.com>
carl
parents: 117
diff changeset
169 html_tags { include "html-tags.conf"; };
94
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
170 html_limit off;
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
171 host_limit soft 20;
178
d6531c702be3 embedded dcc filtering
carl
parents: 175
diff changeset
172 spamassassin 5;
d6531c702be3 embedded dcc filtering
carl
parents: 175
diff changeset
173 require_match yes;
d6531c702be3 embedded dcc filtering
carl
parents: 175
diff changeset
174 dcc_greylist yes;
d6531c702be3 embedded dcc filtering
carl
parents: 175
diff changeset
175 dcc_bulk_threshold 20;
94
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
176 };
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
177
298
4dd677e3b509 add linode.com to generic regex
Carl Byington <carl@five-ten-sg.com>
parents: 278
diff changeset
178 generic "^li.*members.linode.com$|^dsl.static.*ttnet.net.tr$|(^|[x.-])(ppp|h|host)?([0-9]{1,3}[x.-](Red-|dynamic[x.-])?){4}"
168
6bac960af6b4 add generic reverse dns filtering regex
carl
parents: 167
diff changeset
179 "your mail server %s seems to have a generic name";
6bac960af6b4 add generic reverse dns filtering regex
carl
parents: 167
diff changeset
180
233
5c3e9bf45bb5 Add whitelisting by regex expression filtering.
Carl Byington <carl@five-ten-sg.com>
parents: 216
diff changeset
181 white_regex "=example.com=user@yourhostingaccount.com$";
5c3e9bf45bb5 Add whitelisting by regex expression filtering.
Carl Byington <carl@five-ten-sg.com>
parents: 216
diff changeset
182
94
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
183 env_to {
100
63e8633abc34 allow empty env_to at global context to remove all restrictions on child contexts
carl
parents: 94
diff changeset
184 # !! replace this with your domain names
63e8633abc34 allow empty env_to at global context to remove all restrictions on child contexts
carl
parents: 94
diff changeset
185 # child contexts are not allowed to specify recipient addresses outside these domains
179
8b86a894514d embedded dcc filtering
carl
parents: 178
diff changeset
186 # if this is a backup-mx, you need to include here domains for which you relay to the primary mx
174
da0c41b9f672 don't whitelist addresses with embedded spaces
carl
parents: 172
diff changeset
187 include "/etc/mail/local-host-names";
94
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
188 };
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
189
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
190 context whitelist {
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
191 content off {};
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
192 env_to {
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
193 # dcc_to ok { include "/var/dcc/whitecommon"; };
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
194 };
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
195 env_from white {}; # white forces all unmatched from addresses (everyone in this case) to be whitelisted
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
196 # so all mail TO these env_to addresses is accepted
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
197 };
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
198
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
199 context abuse {
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
200 dnsbl_list xbl;
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
201 content off {};
174
da0c41b9f672 don't whitelist addresses with embedded spaces
carl
parents: 172
diff changeset
202 generic "^$ " " "; # regex cannot match, to disable generic rdns rejects
94
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
203 env_to {
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
204 abuse@ # no content filtering on abuse reports
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
205 postmaster@ # ""
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
206 };
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
207 env_from unknown {}; # ignore all parent white/black listing
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
208 };
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
209
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
210 context minimal {
171
8deb51871b3d fix pre/post scripts in rpm spec file
carl
parents: 168
diff changeset
211 dnsbl_list sbl;
178
d6531c702be3 embedded dcc filtering
carl
parents: 175
diff changeset
212 content on {
d6531c702be3 embedded dcc filtering
carl
parents: 175
diff changeset
213 spamassassin 10;
d6531c702be3 embedded dcc filtering
carl
parents: 175
diff changeset
214 dcc_bulk_threshold many;
d6531c702be3 embedded dcc filtering
carl
parents: 175
diff changeset
215 };
171
8deb51871b3d fix pre/post scripts in rpm spec file
carl
parents: 168
diff changeset
216 generic "^$ " " "; # regex cannot match, to disable generic rdns rejects
94
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
217 env_to {
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
218 };
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
219 };
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
220
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
221 context blacklist {
255
d6d5c50b9278 Allow dnswl_list and dnsbl_list to be empty, to override lists specified in the ancestor contexts. Add daily recipient limits as a multiple of the hourly limits.
Carl Byington <carl@five-ten-sg.com>
parents: 249
diff changeset
222 dnsbl_list ;
d6d5c50b9278 Allow dnswl_list and dnsbl_list to be empty, to override lists specified in the ancestor contexts. Add daily recipient limits as a multiple of the hourly limits.
Carl Byington <carl@five-ten-sg.com>
parents: 249
diff changeset
223 dnswl_list ;
94
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
224 env_to {
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
225 # dcc_to many { include "/var/dcc/whitecommon"; };
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
226 };
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
227 env_from black {}; # black forces all unmatched from addresses (everyone in this case) to be blacklisted
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
228 # so all mail TO these env_to addresses is rejected
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
229 };
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
230
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
231 env_from unknown {
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
232 abuse@ abuse; # replies to abuse reports use the abuse context
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
233 # dcc_from { include "/var/dcc/whitecommon"; };
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
234 };
153
8d7c439bb6fa add auto whitelisting
carl
parents: 144
diff changeset
235
167
9b129ed78d7d actually use spamassassin result, allow build without spam assassin, only call it if some recipient needs it.
carl
parents: 165
diff changeset
236 autowhite 90 "autowhite/my-auto-whitelist";
9b129ed78d7d actually use spamassassin result, allow build without spam assassin, only call it if some recipient needs it.
carl
parents: 165
diff changeset
237 # install should create /etc/dnsbl/autowhite writable by userid dnsbl
94
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
238 };
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
239