Mercurial > dnsbl
annotate xml/dnsbl.in @ 395:a8cf6a3da907 stable-6-0-52
document dkim/spf processing
| author | Carl Byington <carl@five-ten-sg.com> |
|---|---|
| date | Tue, 07 Mar 2017 09:39:25 -0800 |
| parents | 17f21fcd44a8 |
| children | d08da4b058e8 |
| rev | line source |
|---|---|
| 108 | 1 <reference> |
| 2 <title>@PACKAGE@ Sendmail milter - Version @VERSION@</title> | |
| 3 <partintro> | |
| 4 <title>Packages</title> | |
|
201
752d4315675c
add reference to mercurial repository in the documentation
Carl Byington <carl@five-ten-sg.com>
parents:
187
diff
changeset
|
5 |
|
305
1f40b1b0ad31
add bitcoin donation address
Carl Byington <carl@five-ten-sg.com>
parents:
284
diff
changeset
|
6 <para> |
|
1f40b1b0ad31
add bitcoin donation address
Carl Byington <carl@five-ten-sg.com>
parents:
284
diff
changeset
|
7 The various source and binary packages are available at <ulink |
|
1f40b1b0ad31
add bitcoin donation address
Carl Byington <carl@five-ten-sg.com>
parents:
284
diff
changeset
|
8 url="http://www.five-ten-sg.com/@PACKAGE@/packages/">http://www.five-ten-sg.com/@PACKAGE@/packages/</ulink>. |
|
1f40b1b0ad31
add bitcoin donation address
Carl Byington <carl@five-ten-sg.com>
parents:
284
diff
changeset
|
9 The most recent documentation is available at <ulink |
|
1f40b1b0ad31
add bitcoin donation address
Carl Byington <carl@five-ten-sg.com>
parents:
284
diff
changeset
|
10 url="http://www.five-ten-sg.com/@PACKAGE@/">http://www.five-ten-sg.com/@PACKAGE@/</ulink>. |
|
201
752d4315675c
add reference to mercurial repository in the documentation
Carl Byington <carl@five-ten-sg.com>
parents:
187
diff
changeset
|
11 </para> |
|
752d4315675c
add reference to mercurial repository in the documentation
Carl Byington <carl@five-ten-sg.com>
parents:
187
diff
changeset
|
12 |
|
305
1f40b1b0ad31
add bitcoin donation address
Carl Byington <carl@five-ten-sg.com>
parents:
284
diff
changeset
|
13 <para> |
|
1f40b1b0ad31
add bitcoin donation address
Carl Byington <carl@five-ten-sg.com>
parents:
284
diff
changeset
|
14 A <ulink |
|
1f40b1b0ad31
add bitcoin donation address
Carl Byington <carl@five-ten-sg.com>
parents:
284
diff
changeset
|
15 url="http://www.selenic.com/mercurial/wiki/">Mercurial</ulink> source |
|
1f40b1b0ad31
add bitcoin donation address
Carl Byington <carl@five-ten-sg.com>
parents:
284
diff
changeset
|
16 code repository for this project is available at <ulink |
|
1f40b1b0ad31
add bitcoin donation address
Carl Byington <carl@five-ten-sg.com>
parents:
284
diff
changeset
|
17 url="http://hg.five-ten-sg.com/@PACKAGE@/">http://hg.five-ten-sg.com/@PACKAGE@/</ulink>. |
| 108 | 18 </para> |
| 94 | 19 |
|
305
1f40b1b0ad31
add bitcoin donation address
Carl Byington <carl@five-ten-sg.com>
parents:
284
diff
changeset
|
20 <para> |
|
1f40b1b0ad31
add bitcoin donation address
Carl Byington <carl@five-ten-sg.com>
parents:
284
diff
changeset
|
21 Bitcoin donations for this project may be sent to |
|
1f40b1b0ad31
add bitcoin donation address
Carl Byington <carl@five-ten-sg.com>
parents:
284
diff
changeset
|
22 <ulink url="bitcoin:17n5xJZ9a8csJW2uLeZn7i6jegNKGdLUPJ">bitcoin:17n5xJZ9a8csJW2uLeZn7i6jegNKGdLUPJ</ulink> |
|
1f40b1b0ad31
add bitcoin donation address
Carl Byington <carl@five-ten-sg.com>
parents:
284
diff
changeset
|
23 </para> |
| 108 | 24 </partintro> |
| 94 | 25 |
| 108 | 26 <refentry id="@PACKAGE@.1"> |
| 27 <refentryinfo> | |
|
395
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
28 <date>2017-03-07</date> |
|
261
92a98e661a0b
update documentation for newer xml dtd
Carl Byington <carl@five-ten-sg.com>
parents:
259
diff
changeset
|
29 <author> |
|
92a98e661a0b
update documentation for newer xml dtd
Carl Byington <carl@five-ten-sg.com>
parents:
259
diff
changeset
|
30 <firstname>Carl</firstname> |
|
92a98e661a0b
update documentation for newer xml dtd
Carl Byington <carl@five-ten-sg.com>
parents:
259
diff
changeset
|
31 <surname>Byington</surname> |
|
92a98e661a0b
update documentation for newer xml dtd
Carl Byington <carl@five-ten-sg.com>
parents:
259
diff
changeset
|
32 <affiliation><orgname>510 Software Group</orgname></affiliation> |
|
92a98e661a0b
update documentation for newer xml dtd
Carl Byington <carl@five-ten-sg.com>
parents:
259
diff
changeset
|
33 </author> |
| 108 | 34 </refentryinfo> |
| 94 | 35 |
| 108 | 36 <refmeta> |
| 37 <refentrytitle>@PACKAGE@</refentrytitle> | |
| 38 <manvolnum>1</manvolnum> | |
| 39 <refmiscinfo>@PACKAGE@ @VERSION@</refmiscinfo> | |
| 40 </refmeta> | |
| 41 | |
| 42 <refnamediv id='name.1'> | |
| 43 <refname>@PACKAGE@</refname> | |
| 44 <refpurpose>a sendmail milter with per-user dnsbl filtering</refpurpose> | |
| 45 </refnamediv> | |
| 94 | 46 |
| 108 | 47 <refsynopsisdiv id='synopsis.1'> |
| 48 <title>Synopsis</title> | |
| 49 <cmdsynopsis> | |
| 50 <command>@PACKAGE@</command> | |
| 51 <arg><option>-c</option></arg> | |
| 52 <arg><option>-s</option></arg> | |
| 53 <arg><option>-d <replaceable class="parameter">n</replaceable></option></arg> | |
| 54 <arg><option>-e <replaceable class="parameter">from|to</replaceable></option></arg> | |
| 179 | 55 <arg><option>-b <replaceable class="parameter">local-domain-socket</replaceable></option></arg> |
| 108 | 56 <arg><option>-r <replaceable class="parameter">local-domain-socket</replaceable></option></arg> |
| 57 <arg><option>-p <replaceable class="parameter">sendmail-socket</replaceable></option></arg> | |
| 58 <arg><option>-t <replaceable class="parameter">timeout</replaceable></option></arg> | |
| 59 </cmdsynopsis> | |
| 60 </refsynopsisdiv> | |
| 94 | 61 |
| 108 | 62 <refsect1 id='options.1'> |
| 63 <title>Options</title> | |
| 64 <variablelist> | |
| 65 <varlistentry> | |
| 66 <term>-c</term> | |
| 111 | 67 <listitem><para> |
| 68 Load the configuration file, print a cannonical form | |
| 69 of the configuration on stdout, and exit. | |
| 70 </para></listitem> | |
| 108 | 71 </varlistentry> |
| 72 <varlistentry> | |
| 73 <term>-s</term> | |
| 111 | 74 <listitem><para> |
| 75 Stress test the configuration loading code by repeating | |
| 76 the load/free cycle in an infinite loop. | |
| 77 </para></listitem> | |
| 108 | 78 </varlistentry> |
| 79 <varlistentry> | |
| 80 <term>-d <replaceable class="parameter">n</replaceable></term> | |
| 111 | 81 <listitem><para> |
| 82 Set the debug level to <replaceable class="parameter">n</replaceable>. | |
| 83 </para></listitem> | |
| 108 | 84 </varlistentry> |
| 85 <varlistentry> | |
| 86 <term>-e <replaceable class="parameter">from|to</replaceable></term> | |
| 111 | 87 <listitem><para> |
| 88 Print the results of looking up the from and to addresses in the | |
| 89 current configuration. The | character is used to separate the from and to | |
| 90 addresses in the argument to the -e switch. | |
| 91 </para></listitem> | |
| 108 | 92 </varlistentry> |
| 93 <varlistentry> | |
| 179 | 94 <term>-b <replaceable class="parameter">local-domain-socket-file-name</replaceable></term> |
| 95 <listitem><para> | |
| 96 Set the local socket used for the connection to the dccifd daemon. | |
| 97 This is typically /var/dcc/dccifd. | |
| 98 </para></listitem> | |
| 99 </varlistentry> | |
| 100 <varlistentry> | |
| 101 <term>-r <replaceable class="parameter">local-domain-socket-file-name</replaceable></term> | |
| 111 | 102 <listitem><para> |
| 103 Set the local socket used for the connection to our own dns resolver processes. | |
| 104 </para></listitem> | |
| 108 | 105 </varlistentry> |
| 106 <varlistentry> | |
| 107 <term>-p <replaceable class="parameter">sendmail-socket</replaceable></term> | |
| 111 | 108 <listitem><para> |
| 109 Set the socket used for the milter connection to sendmail. This is either | |
| 110 "inet:port@ip-address" or "local:local-domain-socket-file-name". | |
| 111 </para></listitem> | |
| 108 | 112 </varlistentry> |
| 113 <varlistentry> | |
| 114 <term>-t <replaceable class="parameter">timeout</replaceable></term> | |
| 111 | 115 <listitem><para> |
| 116 Set the timeout in seconds used for communication with sendmail. | |
| 117 </para></listitem> | |
| 108 | 118 </varlistentry> |
| 119 </variablelist> | |
| 120 </refsect1> | |
| 94 | 121 |
| 111 | 122 <refsect1 id='usage.1'> |
| 108 | 123 <title>Usage</title> |
| 124 <para><command>@PACKAGE@</command> -c</para> | |
| 125 <para><command>@PACKAGE@</command> -s</para> | |
| 111 | 126 <para><command>@PACKAGE@</command> -e 'someone@aol.com|localname@mydomain.tld'</para> |
| 127 <para><command>@PACKAGE@</command> -d 10 -r resolver.sock -p local:dnsbl.sock</para> | |
| 128 </refsect1> | |
| 129 | |
| 130 <refsect1 id='installation.1'> | |
| 131 <title>Installation</title> | |
| 132 <para> | |
| 133 This is now a standard GNU autoconf/automake installation, so the normal | |
| 134 "./configure; make; su; make install" works. "make chkconfig" will | |
| 135 setup the init.d runlevel scripts. Alternatively, you can use the | |
| 136 source or binary RPMs at <ulink | |
| 137 url="http://www.five-ten-sg.com/@PACKAGE@/packages">http://www.five-ten-sg.com/@PACKAGE@/packages</ulink>. | |
| 138 </para> | |
| 139 <para> | |
| 140 Note that this has ONLY been tested on Linux, specifically RedHat Linux. | |
| 141 In particular, this milter makes no attempt to understand IPv6. Your | |
| 142 mileage will vary. You will need at a minimum a C++ compiler with a | |
| 143 minimally thread safe STL implementation. The distribution includes a | |
| 144 test.cpp program. If it fails this milter won't work. If it passes, | |
| 145 this milter might work. | |
| 146 </para> | |
| 147 <para> | |
| 148 Modify your sendmail.mc by removing all the "FEATURE(dnsbl" lines, add | |
| 149 the following line in your sendmail.mc and rebuild the .cf file | |
| 150 </para> | |
| 151 <para><screen>INPUT_MAIL_FILTER(`dnsbl', `S=local:/var/run/dnsbl/dnsbl.sock, F=T, T=C:30s;S:5m;R:5m;E:5m')</screen></para> | |
| 152 <para> | |
| 153 Modify the default <citerefentry> | |
| 154 <refentrytitle>@PACKAGE@.conf</refentrytitle> <manvolnum>5</manvolnum> | |
| 155 </citerefentry> configuration. | |
| 156 </para> | |
| 157 </refsect1> | |
| 158 | |
| 159 <refsect1 id='configuration.1'> | |
| 160 <title>Configuration</title> | |
| 161 <para> | |
| 162 The configuration file is documented in <citerefentry> | |
| 163 <refentrytitle>@PACKAGE@.conf</refentrytitle> <manvolnum>5</manvolnum> | |
| 164 </citerefentry>. Any change to the config file, or any file included | |
| 165 from that config file, will cause it to be reloaded within three | |
| 166 minutes. | |
| 167 </para> | |
| 108 | 168 </refsect1> |
| 94 | 169 |
| 108 | 170 <refsect1 id='introduction.1'> |
| 171 <title>Introduction</title> | |
| 172 <para> | |
| 173 Consider the case of a mail server that is acting as secondary MX for a | |
| 174 collection of clients, each of which has a collection of mail domains. | |
| 175 Each client may use their own collection of DNSBLs on their primary mail | |
| 176 server. We present here a mechanism whereby the backup mail server can | |
| 177 use the correct set of DNSBLs for each recipient for each message. As a | |
| 178 side-effect, it gives us the ability to customize the set of DNSBLs on a | |
| 183 | 179 per-recipient basis, so that fred@example.com could use LOCAL and the |
| 108 | 180 SBL, where all other users @example.com use only the SBL. |
| 181 </para> | |
| 182 <para> | |
| 183 This milter can also verify the envelope from/recipient pairs with the | |
| 184 primary MX server. This allows the backup mail servers to properly | |
| 185 reject mail sent to invalid addresses. Otherwise, the backup mail | |
| 186 servers will accept that mail, and then generate a bounce message when | |
| 187 the message is forwarded to the primary server (and rejected there with | |
| 127 | 188 no such user). These rejections are the primary cause of such backscatter. |
| 108 | 189 </para> |
| 190 <para> | |
| 191 This milter will also decode (uuencode, base64, mime, html entity, url | |
| 192 encodings) and scan for HTTP and HTTPS URLs and bare hostnames in the | |
| 193 body of the mail. If any of those host names have A or NS records on | |
| 194 the SBL (or a single configurable DNSBL), the mail will be rejected | |
| 195 unless previously whitelisted. This milter also counts the number of | |
| 196 invalid HTML tags, and can reject mail if that count exceeds your | |
| 197 specified limit. | |
| 198 </para> | |
| 199 <para> | |
|
259
be939802c64e
add recipient rate limits by email from address or domain
Carl Byington <carl@five-ten-sg.com>
parents:
255
diff
changeset
|
200 This milter can also impose hourly and daily rate |
|
be939802c64e
add recipient rate limits by email from address or domain
Carl Byington <carl@five-ten-sg.com>
parents:
255
diff
changeset
|
201 limits on the number of recipients accepted from SMTP |
|
be939802c64e
add recipient rate limits by email from address or domain
Carl Byington <carl@five-ten-sg.com>
parents:
255
diff
changeset
|
202 AUTH connections, that would otherwise be allowed to |
|
be939802c64e
add recipient rate limits by email from address or domain
Carl Byington <carl@five-ten-sg.com>
parents:
255
diff
changeset
|
203 relay thru this mail server with no spam filtering. If |
|
be939802c64e
add recipient rate limits by email from address or domain
Carl Byington <carl@five-ten-sg.com>
parents:
255
diff
changeset
|
204 the connection does not use SMTP AUTH, the rate limits |
|
be939802c64e
add recipient rate limits by email from address or domain
Carl Byington <carl@five-ten-sg.com>
parents:
255
diff
changeset
|
205 may be specified by the mail from email address or |
|
be939802c64e
add recipient rate limits by email from address or domain
Carl Byington <carl@five-ten-sg.com>
parents:
255
diff
changeset
|
206 domain. |
| 136 | 207 </para> |
| 208 <para> | |
|
284
896b9393d3f0
Fix segfault caused by freeing unallocated memory
Carl Byington <carl@five-ten-sg.com>
parents:
278
diff
changeset
|
209 This milter can also impose hourly and daily limits on the number of |
|
896b9393d3f0
Fix segfault caused by freeing unallocated memory
Carl Byington <carl@five-ten-sg.com>
parents:
278
diff
changeset
|
210 different ip addresses used for SMTP AUTH connections. If a single |
|
896b9393d3f0
Fix segfault caused by freeing unallocated memory
Carl Byington <carl@five-ten-sg.com>
parents:
278
diff
changeset
|
211 user is connecting from too many different ip addresses, we presume that |
|
896b9393d3f0
Fix segfault caused by freeing unallocated memory
Carl Byington <carl@five-ten-sg.com>
parents:
278
diff
changeset
|
212 their authentication credentials have been discovered, and block their |
|
896b9393d3f0
Fix segfault caused by freeing unallocated memory
Carl Byington <carl@five-ten-sg.com>
parents:
278
diff
changeset
|
213 outgoing mail. |
|
896b9393d3f0
Fix segfault caused by freeing unallocated memory
Carl Byington <carl@five-ten-sg.com>
parents:
278
diff
changeset
|
214 </para> |
|
896b9393d3f0
Fix segfault caused by freeing unallocated memory
Carl Byington <carl@five-ten-sg.com>
parents:
278
diff
changeset
|
215 <para> |
| 162 | 216 Consider the case of a message from A to B passing thru this milter. If |
| 217 that message is not blocked, then we might eventually see a reply | |
| 156 | 218 message from B to A. If the filtering context for A includes an |
| 162 | 219 autowhite entry, and that context does <emphasis>not</emphasis> cover B |
| 220 as a recipient, then this milter will add an entry in that file to | |
| 221 whitelist such replies for a configurable time period. Suppose A and B | |
| 222 are in the same domain, or at least use the same filtering context. In | |
| 223 that case we don't want to add a whitelist entry for B, since that would | |
| 224 then allow spammers to send mail from B (forged) to B. Such autowhite | |
| 160 | 225 files need to be writeable by the dnsbl user, where all the other dnsbl |
| 226 configuration files only need to be readable by the dnsbl user. | |
| 156 | 227 </para> |
| 228 <para> | |
|
176
4ec928b24bab
allow manual whitelisting with stamp 1 to remove a whitelist entry
carl
parents:
175
diff
changeset
|
229 You can manually add such an autowhite entry, by appending a single |
|
4ec928b24bab
allow manual whitelisting with stamp 1 to remove a whitelist entry
carl
parents:
175
diff
changeset
|
230 text line to the autowhitelist file, using something like |
|
4ec928b24bab
allow manual whitelisting with stamp 1 to remove a whitelist entry
carl
parents:
175
diff
changeset
|
231 <command>echo "$mail 0" >>$autowhitefile</command>. |
|
4ec928b24bab
allow manual whitelisting with stamp 1 to remove a whitelist entry
carl
parents:
175
diff
changeset
|
232 You can manually remove such an autowhite entry, by appending a single |
|
4ec928b24bab
allow manual whitelisting with stamp 1 to remove a whitelist entry
carl
parents:
175
diff
changeset
|
233 text line to the autowhitelist file, using something like |
|
4ec928b24bab
allow manual whitelisting with stamp 1 to remove a whitelist entry
carl
parents:
175
diff
changeset
|
234 <command>echo "$mail 1" >>$autowhitefile</command>. |
|
4ec928b24bab
allow manual whitelisting with stamp 1 to remove a whitelist entry
carl
parents:
175
diff
changeset
|
235 </para> |
|
4ec928b24bab
allow manual whitelisting with stamp 1 to remove a whitelist entry
carl
parents:
175
diff
changeset
|
236 <para> |
| 108 | 237 The DNSBL milter reads a text configuration file (dnsbl.conf) on |
| 238 startup, and whenever the config file (or any of the referenced include | |
| 239 files) is changed. The entire configuration file is case insensitive. | |
| 240 If the configuration cannot be loaded due to a syntax error, the milter | |
| 241 will log the error and quit. If the configuration cannot be reloaded | |
| 242 after being modified, the milter will log the error and send an email to | |
| 152 | 243 root from dnsbl@$hostname. You probably want to add dnsbl@$hostname |
| 108 | 244 to your /etc/mail/virtusertable since otherwise sendmail will reject |
| 245 that message. | |
| 246 </para> | |
| 247 </refsect1> | |
| 94 | 248 |
| 111 | 249 <refsect1 id='dcc.1'> |
| 108 | 250 <title>DCC Issues</title> |
| 251 <para> | |
| 252 If you are also using the <ulink | |
| 253 url="http://www.rhyolite.com/anti-spam/dcc/">DCC</ulink> milter, there | |
| 254 are a few considerations. You may need to whitelist senders from the | |
| 255 DCC bulk detector, or from the DNS based lists. Those are two very | |
| 256 different reasons for whitelisting. The former is done thru the DCC | |
| 257 whiteclnt config file, the later is done thru the DNSBL milter config | |
| 258 file. | |
| 259 </para> | |
| 260 <para> | |
| 261 You may want to blacklist some specific senders or sending domains. | |
| 262 This could be done thru either the DCC (on a global basis, or for a | |
| 263 specific single recipient). We prefer to do such blacklisting via the | |
| 264 DNSBL milter config, since it can be done for a collection of recipient | |
| 265 mail domains. The DCC approach has the feature that you can capture the | |
| 266 entire message in the DCC log files. The DNSBL milter approach has the | |
| 267 feature that the mail is rejected earlier (at RCPT TO time), and the | |
| 268 sending machine just gets a generic "550 5.7.1 no such user" message. | |
| 269 </para> | |
| 270 <para> | |
| 271 The DCC whiteclnt file can be included in the DNSBL milter config by the | |
| 272 dcc_to and dcc_from statements. This will import the (env_to, env_from, | |
| 273 and substitute mail_host) entries from the DCC config into the DNSBL | |
| 274 config. This allows using the DCC config as the single point for | |
| 275 white/blacklisting. | |
| 276 </para> | |
| 277 <para> | |
| 278 Consider the case where you have multiple clients, each with their own | |
| 279 mail servers, and each running their own DCC milters. Each client is | |
| 280 using the DCC facilities for envelope from/to white/blacklisting. | |
| 281 Presumably you can use rsync or scp to fetch copies of your clients DCC | |
| 282 whiteclnt files on a regular basis. Your mail server, acting as a | |
| 283 backup MX for your clients, can use the DNSBL milter, and include those | |
| 284 client DCC config files. The envelope from/to white/blacklisting will | |
| 285 be appropriately tagged and used only for the domains controlled by each | |
| 286 of those clients. | |
| 287 </para> | |
| 179 | 288 <para> |
| 289 You can now use (via dccifd) different dcc filtering parameters on a per | |
| 290 context basis. See the dcc_greylist and dcc_bulk_threshold statements | |
| 291 in the <citerefentry> <refentrytitle>@PACKAGE@.conf</refentrytitle> | |
| 292 <manvolnum>5</manvolnum> </citerefentry> configuration. Those | |
| 293 statements are only active if you supply the <option>-b</option> option | |
| 294 on the dnsbl command line. If you use the dcc via the standard dcc | |
| 295 milter (dccm), then connections from clients that use SMTP AUTH are | |
| 296 still subject to greylisting. If you use the dcc via dccifd and this | |
| 297 milter, then connections from clients that use SMTP AUTH are never | |
| 180 | 298 subject to greylisting. As part of this per-user greylisting, you need |
| 299 to move the dnsblnogrey file from the config directory to something | |
| 300 like /var/dcc/userdirs/local/dnsblnogrey/whiteclnt so the dccifd will | |
| 301 properly ignore greylisting for those recipients that don't want it. | |
| 179 | 302 </para> |
| 108 | 303 </refsect1> |
| 94 | 304 |
| 111 | 305 <refsect1 id='definitions.1'> |
| 108 | 306 <title>Definitions</title> |
| 307 <para> | |
| 308 CONTEXT - a collection of parameters that defines the filtering context | |
| 309 to be used for a collection of envelope recipient addresses. The | |
| 310 context includes such things as the list of DNSBLs to be used, and the | |
| 311 various content filtering parameters. | |
| 312 </para> | |
| 313 <para> | |
| 314 DNSBL - a named DNS based blocking list is defined by a dns suffix (e.g. | |
| 315 sbl-xbl.spamhaus.org) and a message string that is used to generate the | |
| 316 "550 5.7.1" smtp error return code. The names of these DNSBLs will be | |
| 317 used to define the DNSBL-LISTs. | |
| 318 </para> | |
| 319 <para> | |
| 320 DNSBL-LIST - a named list of DNSBLs that will be used for specific | |
| 321 recipients or recipient domains. | |
| 322 </para> | |
| 249 | 323 <para> |
| 324 DNSWL - a named DNS based white list is defined by a dns suffix (e.g. | |
| 325 list.dnswl.org) and an integer level. If the level is greater than or | |
| 326 equal to x in the 127.0.z.x return code from the white list, then the | |
| 327 ip address is considered to match, and the message will be whitelisted. | |
| 328 The names of these DNSWLs will be used to define the DNSWL-LISTs. | |
| 329 </para> | |
| 330 <para> | |
| 331 DNSWL-LIST - a named list of DNSWLs that will be used for specific | |
| 332 recipients or recipient domains. | |
| 333 </para> | |
| 108 | 334 </refsect1> |
| 94 | 335 |
| 111 | 336 <refsect1 id='filtering.1'> |
| 108 | 337 <title>Filtering Procedure</title> |
| 338 <para> | |
| 152 | 339 The SMTP envelope 'from' and 'to' values are used in various checks. |
| 340 The first check is to see if a reply message (swapping the env_from and | |
| 160 | 341 env_to values) would be unconditionally blocked (just based on the |
| 342 envelope from address). That check is similar to the main check | |
| 343 described below, but there is no body content to be scanned, and there | |
| 344 is no client connection ip address to be checked against DNSBLs. If | |
| 345 such a reply message would be blocked, we also block the original | |
| 346 outgoing message. This prevents folks from sending mail to recipients | |
| 347 that are unable to reply. | |
| 152 | 348 </para> |
| 349 <para> | |
|
284
896b9393d3f0
Fix segfault caused by freeing unallocated memory
Carl Byington <carl@five-ten-sg.com>
parents:
278
diff
changeset
|
350 If the client has authenticated with sendmail, the recipient rate limits |
|
896b9393d3f0
Fix segfault caused by freeing unallocated memory
Carl Byington <carl@five-ten-sg.com>
parents:
278
diff
changeset
|
351 and connection ip address limits are |
|
268
f941563c2a95
Add require_rdns checking
Carl Byington <carl@five-ten-sg.com>
parents:
263
diff
changeset
|
352 checked. If the authenticated user has not exceeded the hourly or daily rate |
|
f941563c2a95
Add require_rdns checking
Carl Byington <carl@five-ten-sg.com>
parents:
263
diff
changeset
|
353 limits, then the mail is accepted, the filtering contexts are not used, |
|
284
896b9393d3f0
Fix segfault caused by freeing unallocated memory
Carl Byington <carl@five-ten-sg.com>
parents:
278
diff
changeset
|
354 the dns lists are not checked, and the body content is not scanned. These |
|
896b9393d3f0
Fix segfault caused by freeing unallocated memory
Carl Byington <carl@five-ten-sg.com>
parents:
278
diff
changeset
|
355 rate limits can also be applied to unauthenticated connections, in which case |
|
896b9393d3f0
Fix segfault caused by freeing unallocated memory
Carl Byington <carl@five-ten-sg.com>
parents:
278
diff
changeset
|
356 the envelope from value is used as the authentication id for lookup purposes. |
|
896b9393d3f0
Fix segfault caused by freeing unallocated memory
Carl Byington <carl@five-ten-sg.com>
parents:
278
diff
changeset
|
357 If |
| 136 | 358 the client has not authenticated with sendmail, we follow these steps |
| 359 for each recipient. | |
| 108 | 360 </para> |
| 361 <orderedlist> | |
| 111 | 362 <listitem><para> |
| 108 | 363 The envelope to email address is used to find an initial filtering |
| 364 context. We first look for a context that specified the full email | |
| 365 address in the env_to statement. If that is not found, we look for a | |
| 366 context that specified the entire domain name of the envelope recipient | |
| 367 in the env_to statement. If that is not found, we look for a context | |
| 368 that specified the user@ part of the envelope recipient in the env_to | |
| 369 statement. If that is not found, we use the first top level context | |
| 370 defined in the config file. | |
| 111 | 371 </para></listitem> |
| 372 <listitem><para> | |
| 108 | 373 The initial filtering context may redirect to a child context based on |
| 374 the values in the initial context's env_from statement. We look for [1) | |
| 375 the full envelope from email address, 2) the domain name part of the | |
| 376 envelope from address, 3) the user@ part of the envelope from address] | |
| 377 in that context's env_from statement, with values that point to a child | |
| 378 context. If such an entry is found, we switch to that child filtering | |
| 379 context. | |
| 111 | 380 </para></listitem> |
| 381 <listitem><para> | |
| 108 | 382 We lookup [1) the full envelope from email address, 2) the domain name |
| 383 part of the envelope from address, 3) the user@ part of the envelope | |
| 384 from address] in the filtering context env_from statement. That results | |
| 385 in one of (white, black, unknown, inherit). | |
| 111 | 386 </para></listitem> |
| 387 <listitem><para> | |
| 108 | 388 If the answer is black, mail to this recipient is rejected with "no such |
| 389 user", and the dns lists are not checked. | |
| 111 | 390 </para></listitem> |
| 391 <listitem><para> | |
| 108 | 392 If the answer is white, mail to this recipient is accepted and the dns |
|
395
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
393 lists are not checked. However, if the envelope from domain name is |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
394 listed in the current filtering context (or parents) dkim_from with |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
395 "required_signed", |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
396 we downgrade this to white answer to unknown. |
| 111 | 397 </para></listitem> |
| 398 <listitem><para> | |
| 108 | 399 If the answer is unknown, we don't reject yet, but the dns lists will be |
| 400 checked, and the content may be scanned. | |
| 111 | 401 </para></listitem> |
| 402 <listitem><para> | |
| 108 | 403 If the answer is inherit, we repeat the envelope from search in the |
| 404 parent context. | |
| 111 | 405 </para></listitem> |
| 406 <listitem><para> | |
|
233
5c3e9bf45bb5
Add whitelisting by regex expression filtering.
Carl Byington <carl@five-ten-sg.com>
parents:
216
diff
changeset
|
407 If the mail has not been accepted or rejected yet, and the filtering |
|
5c3e9bf45bb5
Add whitelisting by regex expression filtering.
Carl Byington <carl@five-ten-sg.com>
parents:
216
diff
changeset
|
408 context (or any ancestor context) specifies a non-empty whitelist regular |
|
5c3e9bf45bb5
Add whitelisting by regex expression filtering.
Carl Byington <carl@five-ten-sg.com>
parents:
216
diff
changeset
|
409 expression, then we check the envelope from value against that regex. |
|
5c3e9bf45bb5
Add whitelisting by regex expression filtering.
Carl Byington <carl@five-ten-sg.com>
parents:
216
diff
changeset
|
410 The mail is accepted if the envelope from value matches the specified regular |
|
5c3e9bf45bb5
Add whitelisting by regex expression filtering.
Carl Byington <carl@five-ten-sg.com>
parents:
216
diff
changeset
|
411 expression. |
|
5c3e9bf45bb5
Add whitelisting by regex expression filtering.
Carl Byington <carl@five-ten-sg.com>
parents:
216
diff
changeset
|
412 </para></listitem> |
|
5c3e9bf45bb5
Add whitelisting by regex expression filtering.
Carl Byington <carl@five-ten-sg.com>
parents:
216
diff
changeset
|
413 <listitem><para> |
| 249 | 414 If the mail has not been accepted or rejected yet, the dns white lists |
| 415 specified in the filtering context are checked and the mail is accepted | |
| 416 if any list has an A record for the standard dns based lookup scheme | |
| 417 (reversed octets of the client followed by the dns suffix) with a final | |
| 418 octet greater than or equal to the level specified for that dnswl. | |
| 419 </para></listitem> | |
| 420 <listitem><para> | |
| 421 If the mail has not been accepted or rejected yet, the dns black lists | |
| 168 | 422 specified in the filtering context are checked and the mail is rejected |
| 423 if any list has an A record for the standard dns based lookup scheme | |
| 424 (reversed octets of the client followed by the dns suffix). | |
| 425 </para></listitem> | |
| 426 <listitem><para> | |
| 427 If the mail has not been accepted or rejected yet, and the filtering | |
|
268
f941563c2a95
Add require_rdns checking
Carl Byington <carl@five-ten-sg.com>
parents:
263
diff
changeset
|
428 context (or any ancestor context) requires matching reverse dns client |
|
f941563c2a95
Add require_rdns checking
Carl Byington <carl@five-ten-sg.com>
parents:
263
diff
changeset
|
429 name, the mail is rejected if the client name is empty or forged. |
|
f941563c2a95
Add require_rdns checking
Carl Byington <carl@five-ten-sg.com>
parents:
263
diff
changeset
|
430 </para></listitem> |
|
f941563c2a95
Add require_rdns checking
Carl Byington <carl@five-ten-sg.com>
parents:
263
diff
changeset
|
431 <listitem><para> |
|
f941563c2a95
Add require_rdns checking
Carl Byington <carl@five-ten-sg.com>
parents:
263
diff
changeset
|
432 If the mail has not been accepted or rejected yet, and the filtering |
| 170 | 433 context (or any ancestor context) specifies a non-empty generic regular |
| 434 expression, then we check the fully qualified client name (obtained via | |
| 435 the sendmail macro "_"). The mail is rejected if the client name | |
| 436 matches the specified regular expression. | |
| 111 | 437 </para></listitem> |
| 438 <listitem><para> | |
| 108 | 439 If the mail has not been accepted or rejected yet, we look for a |
| 440 verification context, which is the closest ancestor of the filtering | |
| 441 context that both specifies a verification host, and which covers the | |
| 442 envelope to address. If we find such a verification context, and the | |
| 443 verification host is not our own hostname, we open an smtp conversation | |
| 444 with that verification host. The current envelope from and recipient to | |
| 445 values are passed to that verification host. If we receive a 5xy | |
| 446 response those commands, we reject the current recipient with "no such | |
| 447 user". | |
| 111 | 448 </para></listitem> |
| 449 <listitem><para> | |
| 108 | 450 If the mail has not been accepted or rejected yet, and the filtering |
| 451 context enables content filtering, and this is the first such recipient | |
| 452 in this smtp transaction, we set the content filtering parameters from | |
| 453 this context, and enable content filtering for the body of this message. | |
| 111 | 454 </para></listitem> |
| 108 | 455 </orderedlist> |
| 456 <para> | |
| 160 | 457 For each recipient that was accepted, we search for an autowhite entry |
| 458 starting in the reply filtering context. If an autowhite entry is found, | |
| 459 we add the recipient to that auto whitelist file. This will prevent reply | |
| 460 messages from being blocked by the dnsbl or content filtering. | |
| 461 </para> | |
| 462 <para> | |
|
395
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
463 If content filtering is enabled for this body, we look for dkim_signer |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
464 and dkim_from sections in the current context and parents. We collect the |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
465 signers of this message from the header added by the dkim-milter. If any |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
466 of the message signers are whitelisted, the message is accepted. |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
467 </para> |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
468 <para> |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
469 If the header from domain maps to required_signed then: |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
470 If any of the message signers are in that list, the message is accepted. |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
471 If the source ip address passes a strong spf check for the header from |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
472 domain, the message is accepted. Otherwise, the message is rejected. |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
473 </para> |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
474 <para> |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
475 If the header from domain maps to signed_white then: |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
476 If any of the message signers are in that list, the message is accepted. |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
477 If the source ip address passes a strong spf check for the header from |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
478 domain, the message is accepted. Otherwise, processing continues. |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
479 </para> |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
480 <para> |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
481 If the header from domain maps to signed_black then: |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
482 If any of the message signers are in that list, the message is rejected. |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
483 Otherwise, processing continues. |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
484 </para> |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
485 <para> |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
486 If any of the message signers is blacklisted, the message is rejected. |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
487 </para> |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
488 <para> |
| 108 | 489 If content filtering is enabled for this body, the mail text is decoded |
| 119 | 490 (uuencode, base64, mime, html entity, url encodings), and scanned for HTTP |
| 491 and HTTPS URLs or bare host names. Hostnames must be either ip address | |
| 492 literals, or must end in a string defined by the TLD list. The first | |
| 493 <configurable> host names are checked as follows. | |
| 494 </para> | |
| 495 <para> | |
| 496 The only known list that is suitable for the content filter DNSBL is the | |
| 497 SBL. If the content filter DNSBL is defined, and any of those host | |
| 498 names resolve to ip addresses that are on that DNSBL (or have | |
| 499 nameservers that are on that list), and the host name is not on the | |
| 500 <configurable> ignore list, the mail is rejected. | |
| 501 </para> | |
| 502 <para> | |
| 503 If the content uribl DNSBL is defined, and any of those host names are | |
| 504 on that DNSBL, and the host name is not on the <configurable> | |
|
270
f92f24950bd3
Use mozilla prefix list for tld checking, Enable surbl/uribl/dbl rhs lists
Carl Byington <carl@five-ten-sg.com>
parents:
268
diff
changeset
|
505 ignore list, the mail is rejected. There are three lists that are suitable |
|
284
896b9393d3f0
Fix segfault caused by freeing unallocated memory
Carl Byington <carl@five-ten-sg.com>
parents:
278
diff
changeset
|
506 here, URIBL, SURBL, and DBL. |
| 119 | 507 </para> |
| 508 <para> | |
|
167
9b129ed78d7d
actually use spamassassin result, allow build without spam assassin, only call it if some recipient needs it.
carl
parents:
164
diff
changeset
|
509 If any non-whitelisted recipient has a filtering context with a non-zero |
|
9b129ed78d7d
actually use spamassassin result, allow build without spam assassin, only call it if some recipient needs it.
carl
parents:
164
diff
changeset
|
510 spamassassin limit, then the message is passed thru spamassassin (via |
|
9b129ed78d7d
actually use spamassassin result, allow build without spam assassin, only call it if some recipient needs it.
carl
parents:
164
diff
changeset
|
511 spamc), and the message is rejected for those recipients with spamassassin |
|
203
92a5c866bdfa
Verify from/to pairs even if they might be explicitly whitelisted.
Carl Byington <carl@five-ten-sg.com>
parents:
201
diff
changeset
|
512 limits less than the resulting spamassassin score. For example, a |
|
92a5c866bdfa
Verify from/to pairs even if they might be explicitly whitelisted.
Carl Byington <carl@five-ten-sg.com>
parents:
201
diff
changeset
|
513 spamassassin limit of three will reject messages with spamassassin scores |
|
246
8b0f16abee53
Add prvs decoding to envelope addresses
Carl Byington <carl@five-ten-sg.com>
parents:
233
diff
changeset
|
514 of four or greater. If the filtering context has a spamassassin limit of |
|
8b0f16abee53
Add prvs decoding to envelope addresses
Carl Byington <carl@five-ten-sg.com>
parents:
233
diff
changeset
|
515 zero, then spamassassin is not called (or if called the results are not used) |
|
8b0f16abee53
Add prvs decoding to envelope addresses
Carl Byington <carl@five-ten-sg.com>
parents:
233
diff
changeset
|
516 for this recipient. |
|
203
92a5c866bdfa
Verify from/to pairs even if they might be explicitly whitelisted.
Carl Byington <carl@five-ten-sg.com>
parents:
201
diff
changeset
|
517 </para> |
|
92a5c866bdfa
Verify from/to pairs even if they might be explicitly whitelisted.
Carl Byington <carl@five-ten-sg.com>
parents:
201
diff
changeset
|
518 <para> |
|
92a5c866bdfa
Verify from/to pairs even if they might be explicitly whitelisted.
Carl Byington <carl@five-ten-sg.com>
parents:
201
diff
changeset
|
519 If any non-whitelisted recipient has a filtering context that specifies |
|
92a5c866bdfa
Verify from/to pairs even if they might be explicitly whitelisted.
Carl Byington <carl@five-ten-sg.com>
parents:
201
diff
changeset
|
520 DCC greylisting, then the message is passed thru the DCC bulk detector, |
|
92a5c866bdfa
Verify from/to pairs even if they might be explicitly whitelisted.
Carl Byington <carl@five-ten-sg.com>
parents:
201
diff
changeset
|
521 and the message is greylisted (for all recipients) if the DCC says this |
|
92a5c866bdfa
Verify from/to pairs even if they might be explicitly whitelisted.
Carl Byington <carl@five-ten-sg.com>
parents:
201
diff
changeset
|
522 message should be delayed. |
|
92a5c866bdfa
Verify from/to pairs even if they might be explicitly whitelisted.
Carl Byington <carl@five-ten-sg.com>
parents:
201
diff
changeset
|
523 </para> |
|
92a5c866bdfa
Verify from/to pairs even if they might be explicitly whitelisted.
Carl Byington <carl@five-ten-sg.com>
parents:
201
diff
changeset
|
524 <para> |
|
92a5c866bdfa
Verify from/to pairs even if they might be explicitly whitelisted.
Carl Byington <carl@five-ten-sg.com>
parents:
201
diff
changeset
|
525 If any non-whitelisted recipient has a filtering context with a non-zero |
|
92a5c866bdfa
Verify from/to pairs even if they might be explicitly whitelisted.
Carl Byington <carl@five-ten-sg.com>
parents:
201
diff
changeset
|
526 DCC bulk threshold, then the message is passed thru the DCC bulk detector, |
|
92a5c866bdfa
Verify from/to pairs even if they might be explicitly whitelisted.
Carl Byington <carl@five-ten-sg.com>
parents:
201
diff
changeset
|
527 and the message is rejected for those recipients with DCC thresholds less |
|
92a5c866bdfa
Verify from/to pairs even if they might be explicitly whitelisted.
Carl Byington <carl@five-ten-sg.com>
parents:
201
diff
changeset
|
528 than or equal to the DCC bulk score. |
| 163 | 529 </para> |
| 530 <para> | |
| 119 | 531 We also scan for excessive bad html tags, and if a <configurable> |
| 532 limit is exceeded, the mail is rejected. | |
| 108 | 533 </para> |
| 534 </refsect1> | |
| 94 | 535 |
| 111 | 536 <refsect1 id='access.1'> |
| 108 | 537 <title>Sendmail access vs. DNSBL</title> |
| 538 <para> | |
| 539 With the standard sendmail.mc dnsbl FEATURE, the dnsbl checks may be | |
| 540 suppressed by entries in the /etc/mail/access database. For example, | |
| 541 suppose you control a /18 of address space, and have allocated some /24s | |
| 542 to some clients. You have access entries like | |
| 111 | 543 <literallayout class="monospaced"><![CDATA[ |
| 544 192.168.4 OK | |
| 545 192.168.17 OK]]></literallayout> | |
| 108 | 546 </para> |
| 547 <para> | |
| 548 to allow those clients to smarthost thru your mail server. Now if one | |
| 549 of those clients happens get infected with a virus that turns a machine | |
| 550 into an open proxy, and their 192.168.4.45 lands on the SBL-XBL, you | |
| 551 will still wind up allowing that infected machine to smarthost thru your | |
| 552 mail servers. | |
| 553 </para> | |
| 554 <para> | |
| 555 With this DNSBL milter, the sendmail access database cannot override the | |
| 556 dnsbl checks, so that machine won't be able to send mail to or thru your | |
| 557 smarthost mail server (unless the virus/proxy can use smtp-auth). | |
| 558 </para> | |
| 559 <para> | |
| 560 Using the standard sendmail features, you would add access entries to | |
| 561 allow hosts on your local network to relay thru your mail server. Those | |
| 562 OK entries in the sendmail access database will override all the dnsbl | |
| 563 checks. With this DNSBL milter, you will need to have the local users | |
| 564 authenticate with smtp-auth to get the same effect. You might find | |
| 565 <ulink | |
| 566 url="http://www.ists.dartmouth.edu/classroom/sendmail-ssl-how-to.php"> | |
| 567 these directions</ulink> helpful for setting up smtp-auth if you are on | |
| 568 RH Linux. | |
| 569 </para> | |
| 570 </refsect1> | |
| 94 | 571 |
| 111 | 572 <refsect1 id='performance.1'> |
| 108 | 573 <title>Performance Issues</title> |
| 574 <para> | |
| 575 Consider a high volume high performance machine running sendmail. Each | |
| 576 sendmail process can do its own dns resolution. Typically, such dns | |
| 577 resolver libraries are not thread safe, and so must be protected by some | |
| 578 sort of mutex in a threaded environment. When we add a milter to | |
| 579 sendmail, we now have a collection of sendmail processes, and a | |
| 580 collection of milter threads. | |
| 581 </para> | |
| 582 <para> | |
| 583 We will be doing a lot of dns lookups per mail message, and at least | |
| 584 some of those will take many tens of seconds. If all this dns work is | |
| 585 serialized inside the milter, we have an upper limit of about 25K mail | |
| 586 messages per day. That is clearly not sufficient for many sites. | |
| 587 </para> | |
| 588 <para> | |
| 589 Since we want to do parallel dns resolution across those milter threads, | |
| 590 we add another collection of dns resolver processes. Each sendmail | |
| 591 process is talking to a milter thread over a socket, and each milter | |
| 592 thread is talking to a dns resolver process over another socket. | |
| 593 </para> | |
| 594 <para> | |
| 595 Suppose we are processing 20 messages per second, and each message | |
| 596 requires 20 seconds of dns work. Then we will have 400 sendmail | |
| 597 processes, 400 milter threads, and 400 dns resolver processes. Of | |
| 598 course that steady state is very unlikely to happen. | |
| 599 </para> | |
| 600 </refsect1> | |
| 94 | 601 |
| 602 | |
| 111 | 603 <refsect1 id='rejected.1'> |
| 108 | 604 <title>Rejected Ideas</title> |
| 605 <para> | |
| 606 The following ideas have been considered and rejected. | |
| 607 </para> | |
| 608 <para> | |
| 111 | 609 Add max_recipients setting to the context configuration. Recipients in |
| 610 excess of that limit will be rejected, and all the non-whitelisted | |
| 611 recipients will be removed. Current spammers *very* rarely send more | |
| 612 than ten recipients in a single smtp transaction, so this won't stop any | |
| 108 | 613 significant amount of spam. |
| 614 </para> | |
| 615 <para> | |
| 616 Add poison addresses to the configuration. If any recipient is | |
| 617 poison, all recipients are rejected even if they would be whitelisted, | |
| 618 and the data is rejected if sent. I have a collection of spam trap | |
| 619 addresses that would be suitable for such use. Based on my log files, | |
| 620 any mail to those spam trap addresses is rejected based on either dnsbl | |
| 621 lookups or the DCC. So this won't result in blocking any additional | |
| 622 spam. | |
| 623 </para> | |
| 624 <para> | |
| 625 Add an option to only allow one recipient if the return path is | |
| 626 empty. Based on my log files, there is no mail that violates this | |
| 627 check. | |
| 628 </para> | |
| 629 <para> | |
| 630 Reject the mail if the envelope from domain name contains any MX | |
| 631 records pointing to 127.0.0.0/8. I don't see any significant amount of | |
| 632 spam sent with such domain names. | |
| 633 </para> | |
| 634 </refsect1> | |
| 94 | 635 |
| 108 | 636 <refsect1 id='todo.1'> |
| 637 <title>TODO</title> | |
| 638 <para> | |
| 639 The following ideas are under consideration. | |
| 640 </para> | |
| 641 <para> | |
| 276 | 642 Add config switch to require the HELO argument to resolve to an ip address. |
| 643 </para> | |
| 644 <para> | |
|
270
f92f24950bd3
Use mozilla prefix list for tld checking, Enable surbl/uribl/dbl rhs lists
Carl Byington <carl@five-ten-sg.com>
parents:
268
diff
changeset
|
645 Add white/unknown to config for smtp authenticated connections. Currently |
|
284
896b9393d3f0
Fix segfault caused by freeing unallocated memory
Carl Byington <carl@five-ten-sg.com>
parents:
278
diff
changeset
|
646 any authenticated connection is fully whitelisted. The only spam control |
|
896b9393d3f0
Fix segfault caused by freeing unallocated memory
Carl Byington <carl@five-ten-sg.com>
parents:
278
diff
changeset
|
647 on those connections is rate limiting. This feature would allow content based |
|
270
f92f24950bd3
Use mozilla prefix list for tld checking, Enable surbl/uribl/dbl rhs lists
Carl Byington <carl@five-ten-sg.com>
parents:
268
diff
changeset
|
648 spam controls to be applied even to authenticated connections. Add |
|
f92f24950bd3
Use mozilla prefix list for tld checking, Enable surbl/uribl/dbl rhs lists
Carl Byington <carl@five-ten-sg.com>
parents:
268
diff
changeset
|
649 context/authenticated_dnsbl_list and context/content/authenticated. |
|
f92f24950bd3
Use mozilla prefix list for tld checking, Enable surbl/uribl/dbl rhs lists
Carl Byington <carl@five-ten-sg.com>
parents:
268
diff
changeset
|
650 </para> |
|
f92f24950bd3
Use mozilla prefix list for tld checking, Enable surbl/uribl/dbl rhs lists
Carl Byington <carl@five-ten-sg.com>
parents:
268
diff
changeset
|
651 <para> |
|
f92f24950bd3
Use mozilla prefix list for tld checking, Enable surbl/uribl/dbl rhs lists
Carl Byington <carl@five-ten-sg.com>
parents:
268
diff
changeset
|
652 Add an optional list of domains to be enforced on the env_from value for |
|
f92f24950bd3
Use mozilla prefix list for tld checking, Enable surbl/uribl/dbl rhs lists
Carl Byington <carl@five-ten-sg.com>
parents:
268
diff
changeset
|
653 authenticated connections. User abc could be restricted to envelope from |
|
f92f24950bd3
Use mozilla prefix list for tld checking, Enable surbl/uribl/dbl rhs lists
Carl Byington <carl@five-ten-sg.com>
parents:
268
diff
changeset
|
654 values of a.com and b.com, user def could be restricted to envelope from |
|
f92f24950bd3
Use mozilla prefix list for tld checking, Enable surbl/uribl/dbl rhs lists
Carl Byington <carl@five-ten-sg.com>
parents:
268
diff
changeset
|
655 values of dd.com and ee.com. |
|
f92f24950bd3
Use mozilla prefix list for tld checking, Enable surbl/uribl/dbl rhs lists
Carl Byington <carl@five-ten-sg.com>
parents:
268
diff
changeset
|
656 </para> |
|
f92f24950bd3
Use mozilla prefix list for tld checking, Enable surbl/uribl/dbl rhs lists
Carl Byington <carl@five-ten-sg.com>
parents:
268
diff
changeset
|
657 <para> |
| 115 | 658 Look for href="hostname/path" strings that are missing the required |
| 659 http:// protocol header. Such references are still clickable in common | |
| 660 mail software. | |
| 661 </para> | |
| 108 | 662 </refsect1> |
| 94 | 663 |
| 111 | 664 <refsect1 id='copyright.1'> |
| 108 | 665 <title>Copyright</title> |
| 666 <para> | |
|
261
92a98e661a0b
update documentation for newer xml dtd
Carl Byington <carl@five-ten-sg.com>
parents:
259
diff
changeset
|
667 Copyright (C) 2012 by 510 Software Group <carl@five-ten-sg.com> |
| 108 | 668 </para> |
| 669 <para> | |
| 670 This program is free software; you can redistribute it and/or modify it | |
| 671 under the terms of the GNU General Public License as published by the | |
| 160 | 672 Free Software Foundation; either version 3, or (at your option) any |
| 108 | 673 later version. |
| 674 </para> | |
| 675 <para> | |
| 676 You should have received a copy of the GNU General Public License along | |
| 677 with this program; see the file COPYING. If not, please write to the | |
| 678 Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA. | |
| 679 </para> | |
| 680 </refsect1> | |
| 94 | 681 |
| 111 | 682 <refsect1 id='version.1'> |
|
201
752d4315675c
add reference to mercurial repository in the documentation
Carl Byington <carl@five-ten-sg.com>
parents:
187
diff
changeset
|
683 <title>Version</title> |
| 108 | 684 <para> |
|
201
752d4315675c
add reference to mercurial repository in the documentation
Carl Byington <carl@five-ten-sg.com>
parents:
187
diff
changeset
|
685 @VERSION@ |
| 108 | 686 </para> |
| 687 </refsect1> | |
| 688 </refentry> | |
| 689 | |
| 690 | |
| 691 <refentry id="@PACKAGE@.conf.5"> | |
| 692 <refentryinfo> | |
|
395
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
693 <date>2017-03-07</date> |
|
261
92a98e661a0b
update documentation for newer xml dtd
Carl Byington <carl@five-ten-sg.com>
parents:
259
diff
changeset
|
694 <author> |
|
92a98e661a0b
update documentation for newer xml dtd
Carl Byington <carl@five-ten-sg.com>
parents:
259
diff
changeset
|
695 <firstname>Carl</firstname> |
|
92a98e661a0b
update documentation for newer xml dtd
Carl Byington <carl@five-ten-sg.com>
parents:
259
diff
changeset
|
696 <surname>Byington</surname> |
|
92a98e661a0b
update documentation for newer xml dtd
Carl Byington <carl@five-ten-sg.com>
parents:
259
diff
changeset
|
697 <affiliation><orgname>510 Software Group</orgname></affiliation> |
|
92a98e661a0b
update documentation for newer xml dtd
Carl Byington <carl@five-ten-sg.com>
parents:
259
diff
changeset
|
698 </author> |
| 108 | 699 </refentryinfo> |
| 94 | 700 |
| 108 | 701 <refmeta> |
| 702 <refentrytitle>@PACKAGE@.conf</refentrytitle> | |
| 703 <manvolnum>5</manvolnum> | |
| 704 <refmiscinfo>@PACKAGE@ @VERSION@</refmiscinfo> | |
| 705 </refmeta> | |
| 94 | 706 |
| 108 | 707 <refnamediv id='name.5'> |
| 708 <refname>@PACKAGE@.conf</refname> | |
| 111 | 709 <refpurpose>configuration file for @PACKAGE@ sendmail milter</refpurpose> |
| 108 | 710 </refnamediv> |
| 711 | |
| 712 <refsynopsisdiv id='synopsis.5'> | |
| 713 <title>Synopsis</title> | |
| 714 <cmdsynopsis> | |
| 715 <command>@PACKAGE@.conf</command> | |
| 716 </cmdsynopsis> | |
| 717 </refsynopsisdiv> | |
| 94 | 718 |
| 108 | 719 <refsect1 id='description.5'> |
| 720 <title>Description</title> | |
| 721 <para>The <command>@PACKAGE@.conf</command> configuration file is | |
|
148
9330b8d6a56b
add documentation fixes, allow env_from target of inherit
carl
parents:
144
diff
changeset
|
722 specified by this partial bnf description. Comments start with // |
|
9330b8d6a56b
add documentation fixes, allow env_from target of inherit
carl
parents:
144
diff
changeset
|
723 or # and extend to the end of the line. To include the contents |
|
9330b8d6a56b
add documentation fixes, allow env_from target of inherit
carl
parents:
144
diff
changeset
|
724 of some file verbatim in the dnsbl.conf file, use |
|
9330b8d6a56b
add documentation fixes, allow env_from target of inherit
carl
parents:
144
diff
changeset
|
725 <literallayout class="monospaced"><![CDATA[include "<file>";]]></literallayout> |
|
9330b8d6a56b
add documentation fixes, allow env_from target of inherit
carl
parents:
144
diff
changeset
|
726 </para> |
| 108 | 727 |
| 728 <literallayout class="monospaced"><![CDATA[ | |
| 729 CONFIG = {CONTEXT ";"}+ | |
| 730 CONTEXT = "context" NAME "{" {STATEMENT}+ "}" | |
|
321
e172dc10fe24
add dkim white/black listing
Carl Byington <carl@five-ten-sg.com>
parents:
305
diff
changeset
|
731 STATEMENT = ( DNSBL | DNSBLLIST | DNSWL | DNSWLLIST | CONTENT | ENV-TO |
|
e172dc10fe24
add dkim white/black listing
Carl Byington <carl@five-ten-sg.com>
parents:
305
diff
changeset
|
732 | VERIFY | GENERIC | W_REGEX | AUTOWHITE | CONTEXT | ENV-FROM |
|
322
9f8411f3919c
add dkim white/black listing
Carl Byington <carl@five-ten-sg.com>
parents:
321
diff
changeset
|
733 | RATE-LIMIT | REQUIRERDNS) ";" |
| 108 | 734 |
| 124 | 735 DNSBL = "dnsbl" NAME DNSPREFIX ERROR-MSG1 |
|
255
d6d5c50b9278
Allow dnswl_list and dnsbl_list to be empty, to override lists specified in the ancestor contexts. Add daily recipient limits as a multiple of the hourly limits.
Carl Byington <carl@five-ten-sg.com>
parents:
253
diff
changeset
|
736 DNSBLLIST = "dnsbl_list" {NAME}* |
| 108 | 737 |
|
255
d6d5c50b9278
Allow dnswl_list and dnsbl_list to be empty, to override lists specified in the ancestor contexts. Add daily recipient limits as a multiple of the hourly limits.
Carl Byington <carl@five-ten-sg.com>
parents:
253
diff
changeset
|
738 DNSWL = "dnswl" NAME DNSPREFIX LEVEL |
|
d6d5c50b9278
Allow dnswl_list and dnsbl_list to be empty, to override lists specified in the ancestor contexts. Add daily recipient limits as a multiple of the hourly limits.
Carl Byington <carl@five-ten-sg.com>
parents:
253
diff
changeset
|
739 DNSWLLIST = "dnswl_list" {NAME}* |
|
d6d5c50b9278
Allow dnswl_list and dnsbl_list to be empty, to override lists specified in the ancestor contexts. Add daily recipient limits as a multiple of the hourly limits.
Carl Byington <carl@five-ten-sg.com>
parents:
253
diff
changeset
|
740 LEVEL = INTEGER |
| 94 | 741 |
|
268
f941563c2a95
Add require_rdns checking
Carl Byington <carl@five-ten-sg.com>
parents:
263
diff
changeset
|
742 REQUIRERDNS = "require_rdns" ("yes" | "no") |
|
f941563c2a95
Add require_rdns checking
Carl Byington <carl@five-ten-sg.com>
parents:
263
diff
changeset
|
743 |
| 108 | 744 CONTENT = "content" ("on" | "off") "{" {CONTENT-ST}+ "}" |
|
322
9f8411f3919c
add dkim white/black listing
Carl Byington <carl@five-ten-sg.com>
parents:
321
diff
changeset
|
745 CONTENT-ST = (FILTER | URIBL | IGNORE | TLD | HTML-TAGS | HTML-LIMIT | |
|
9f8411f3919c
add dkim white/black listing
Carl Byington <carl@five-ten-sg.com>
parents:
321
diff
changeset
|
746 HOST-LIMIT | SPAMASS | REQUIRE | DCCGREY | DCCBULK | DKIM_SIGNER | |
|
9f8411f3919c
add dkim white/black listing
Carl Byington <carl@five-ten-sg.com>
parents:
321
diff
changeset
|
747 DKIM_FROM) ";" |
| 124 | 748 FILTER = "filter" DNSPREFIX ERROR-MSG2 |
| 749 URIBL = "uribl" DNSPREFIX ERROR-MSG3 | |
| 108 | 750 IGNORE = "ignore" "{" {HOSTNAME [";"]}+ "}" |
| 751 TLD = "tld" "{" {TLD [";"]}+ "}" | |
| 752 HTML-TAGS = "html_tags" "{" {HTMLTAG [";"]}+ "}" | |
| 124 | 753 ERROR-MSG1 = string containing exactly two %s replacement tokens |
| 754 both are replaced with the client ip address | |
| 755 ERROR-MSG2 = string containing exactly two %s replacement tokens | |
| 756 the first is replaced with the hostname, and the second | |
| 757 is replaced with the ip address | |
| 758 ERROR-MSG3 = string containing exactly two %s replacement tokens | |
| 759 both are replaced with the hostname | |
| 108 | 760 |
| 761 HTML-LIMIT = "html_limit" ("on" INTEGER ERROR-MSG | "off") | |
| 762 | |
| 111 | 763 HOST-LIMIT = "host_limit" ("on" INTEGER ERROR-MSG | "off" | |
| 764 "soft" INTEGER) | |
| 178 | 765 SPAMASS = "spamassassin" INTEGER |
| 766 REQUIRE = "require_match" ("yes" | "no") | |
| 767 DCCGREY = "dcc_greylist" ("yes" | "no") | |
| 768 DCCBULK = "dcc_bulk_threshold" (INTEGER | "many" | "off") | |
| 94 | 769 |
|
321
e172dc10fe24
add dkim white/black listing
Carl Byington <carl@five-ten-sg.com>
parents:
305
diff
changeset
|
770 DKIMSIGNER = "dkim_signer" "{" {SIGNING_DOMAIN DEF [";"]}+ "}" |
|
360
17f21fcd44a8
allow quoted comma separated multiple signers in the dkim_from config entries
Carl Byington <carl@five-ten-sg.com>
parents:
322
diff
changeset
|
771 DKIMFROM = "dkim_from" "{" {HEADER_FROM_DOMAIN DKIMVALUE SIGNERS [";"]}+ "}" |
|
321
e172dc10fe24
add dkim white/black listing
Carl Byington <carl@five-ten-sg.com>
parents:
305
diff
changeset
|
772 DKIMVALUE = "signed_white" | "signed_black" | "require_signed" |
|
360
17f21fcd44a8
allow quoted comma separated multiple signers in the dkim_from config entries
Carl Byington <carl@five-ten-sg.com>
parents:
322
diff
changeset
|
773 SIGNERS = quoted comma separated SIGNING_DOMAINs no whitespace |
|
321
e172dc10fe24
add dkim white/black listing
Carl Byington <carl@five-ten-sg.com>
parents:
305
diff
changeset
|
774 |
| 108 | 775 ENV-TO = "env_to" "{" {(TO-ADDR | DCC-TO)}+ "}" |
| 776 TO-ADDR = ADDRESS [";"] | |
| 777 DCC-TO = "dcc_to" ("ok" | "many") "{" DCCINCLUDEFILE "}" ";" | |
| 778 | |
| 779 VERIFY = "verify" HOSTNAME ";" | |
| 168 | 780 GENERIC = "generic" REGULAREXPRESSION ERROR-MSG4 ";" |
|
233
5c3e9bf45bb5
Add whitelisting by regex expression filtering.
Carl Byington <carl@five-ten-sg.com>
parents:
216
diff
changeset
|
781 W-REGEX = "white_regex" REGULAREXPRESSION ";" |
| 168 | 782 ERROR-MSG4 = string containing exactly one %s replacement token |
| 783 which is replaced with the client name | |
| 153 | 784 AUTOWHITE = "autowhite" DAYS FILENAME ";" |
| 108 | 785 |
| 786 ENV_FROM = "env_from" [DEFAULT] "{" {(FROM-ADDR | DCC-FROM)}+ "}" | |
| 787 FROM-ADDR = ADDRESS VALUE [";"] | |
| 788 DCC-FROM = "dcc_from" "{" DCCINCLUDEFILE "}" ";" | |
| 136 | 789 |
|
278
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
276
diff
changeset
|
790 RATE-LIMIT = "rate_limit" DEFAULT_RCPT_LIMIT DAILY_MULTIPLE_RCPT |
|
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
276
diff
changeset
|
791 DEFAULT_IP_LIMIT DAILY_MULTIPLE_IP "{" (RATE)+ "}" |
|
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
276
diff
changeset
|
792 RATE = USER RCPTLIMIT IPLIMIT ";" |
|
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
276
diff
changeset
|
793 RCPTLIMIT = INTEGER |
|
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
276
diff
changeset
|
794 DEFAULT_RCPT_LIMIT = INTEGER |
|
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
276
diff
changeset
|
795 DAILY_MULTIPLE_RCPT = INTEGER |
|
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
276
diff
changeset
|
796 DEFAULT_IP_LIMIT = INTEGER |
|
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
276
diff
changeset
|
797 DAILY_MULTIPLE_IP = INTEGER |
| 136 | 798 |
|
360
17f21fcd44a8
allow quoted comma separated multiple signers in the dkim_from config entries
Carl Byington <carl@five-ten-sg.com>
parents:
322
diff
changeset
|
799 DEF = ("white" | "black" | "unknown") |
|
17f21fcd44a8
allow quoted comma separated multiple signers in the dkim_from config entries
Carl Byington <carl@five-ten-sg.com>
parents:
322
diff
changeset
|
800 DEFAULT = (DEF | "inherit" | "") |
| 108 | 801 ADDRESS = (USER@ | DOMAIN | USER@DOMAIN) |
|
360
17f21fcd44a8
allow quoted comma separated multiple signers in the dkim_from config entries
Carl Byington <carl@five-ten-sg.com>
parents:
322
diff
changeset
|
802 VALUE = (DEF | "inherit" | CHILD-CONTEXT-NAME)]]></literallayout> |
| 108 | 803 </refsect1> |
| 94 | 804 |
| 108 | 805 <refsect1 id='sample.5'> |
| 806 <title>Sample</title> | |
| 807 <literallayout class="monospaced"><![CDATA[ | |
| 127 | 808 context main-default { |
| 809 // outbound dnsbl filtering to catch our own customers that end up on the sbl | |
| 810 dnsbl sbl sbl-xbl.spamhaus.org "Mail from %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s"; | |
| 174 | 811 dnsbl_list sbl; |
| 127 | 812 |
| 813 // outbound content filtering to prevent our own customers from sending spam | |
| 814 content on { | |
| 815 filter sbl-xbl.spamhaus.org "Mail containing %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s"; | |
|
270
f92f24950bd3
Use mozilla prefix list for tld checking, Enable surbl/uribl/dbl rhs lists
Carl Byington <carl@five-ten-sg.com>
parents:
268
diff
changeset
|
816 uribl multi.surbl.org "Mail containing %s rejected - surbl; see http://www.surbl.org/surbl-analysis?d=%s"; |
|
259
be939802c64e
add recipient rate limits by email from address or domain
Carl Byington <carl@five-ten-sg.com>
parents:
255
diff
changeset
|
817 #uribl multi.uribl.com "Mail containing %s rejected - uribl; see http://l.uribl.com/?d=%s"; |
|
270
f92f24950bd3
Use mozilla prefix list for tld checking, Enable surbl/uribl/dbl rhs lists
Carl Byington <carl@five-ten-sg.com>
parents:
268
diff
changeset
|
818 #uribl dbl.spamhaus.org "Mail containing %s rejected - dbl; see http://www.spamhaus.org/query/domain?domain=%s"; |
| 127 | 819 ignore { include "hosts-ignore.conf"; }; |
| 820 tld { include "tld.conf"; }; | |
| 821 html_tags { include "html-tags.conf"; }; | |
| 822 html_limit on 20 "Mail containing excessive bad html tags rejected"; | |
| 823 html_limit off; | |
| 824 host_limit on 20 "Mail containing excessive host names rejected"; | |
| 825 host_limit soft 20; | |
| 178 | 826 spamassassin 4; |
| 827 require_match yes; | |
| 828 dcc_greylist yes; | |
| 829 dcc_bulk_threshold 50; | |
| 127 | 830 }; |
| 831 | |
|
278
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
276
diff
changeset
|
832 // backscatter prevention - do not send bounces for mail that we accepted but could not forward |
| 127 | 833 // we only send bounces to our own customers |
| 834 env_from unknown { | |
| 835 "<>" black; | |
| 836 }; | |
| 136 | 837 |
|
278
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
276
diff
changeset
|
838 // hourly recipient rate limit by smtp auth client id, or unauthenticated mail from address |
|
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
276
diff
changeset
|
839 // hourly unique ip addresses by smtp auth client id, or unauthenticated mail from address |
|
284
896b9393d3f0
Fix segfault caused by freeing unallocated memory
Carl Byington <carl@five-ten-sg.com>
parents:
278
diff
changeset
|
840 // default hourly recipient rate limit is 30 |
|
896b9393d3f0
Fix segfault caused by freeing unallocated memory
Carl Byington <carl@five-ten-sg.com>
parents:
278
diff
changeset
|
841 // daily recipient rate limits are 4 times the hourly limit |
|
278
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
276
diff
changeset
|
842 // default hourly unique ip addresses is 5 |
|
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
276
diff
changeset
|
843 // daily unique ip addresses are 4 times the hourly limit |
|
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
276
diff
changeset
|
844 rate_limit 30 4 5 4 { // default |
|
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
276
diff
changeset
|
845 fred 100 10; // override default limits |
|
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
276
diff
changeset
|
846 joe 10 2; // "" |
|
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
276
diff
changeset
|
847 "sam@somedomain.tld" 500 2; |
|
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
276
diff
changeset
|
848 "@otherdomain.tld" 100 2; |
| 136 | 849 }; |
| 127 | 850 }; |
| 851 | |
| 171 | 852 context main { |
| 853 dnsbl localp partial.blackholes.five-ten-sg.com "Mail from %s rejected - local; see http://www.five-ten-sg.com/blackhole.php?%s"; | |
| 108 | 854 dnsbl local blackholes.five-ten-sg.com "Mail from %s rejected - local; see http://www.five-ten-sg.com/blackhole.php?%s"; |
| 174 | 855 dnsbl sbl zen.spamhaus.org "Mail from %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s"; |
| 108 | 856 dnsbl xbl xbl.spamhaus.org "Mail from %s rejected - xbl; see http://www.spamhaus.org/query/bl?ip=%s"; |
| 249 | 857 dnswl dnswl.org list.dnswl.org 2; |
| 171 | 858 dnsbl_list local sbl; |
| 249 | 859 dnswl_list dnswl.org; |
|
268
f941563c2a95
Add require_rdns checking
Carl Byington <carl@five-ten-sg.com>
parents:
263
diff
changeset
|
860 require_rdns yes; |
| 94 | 861 |
| 108 | 862 content on { |
|
360
17f21fcd44a8
allow quoted comma separated multiple signers in the dkim_from config entries
Carl Byington <carl@five-ten-sg.com>
parents:
322
diff
changeset
|
863 dkim_signer { |
|
395
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
864 # |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
865 # anything signed by this is accepted. |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
866 accounts.google.com white; |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
867 }; |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
868 dkim_from { |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
869 # |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
870 # white/blacklisting based on presence of valid signatures |
|
360
17f21fcd44a8
allow quoted comma separated multiple signers in the dkim_from config entries
Carl Byington <carl@five-ten-sg.com>
parents:
322
diff
changeset
|
871 credit.paypal.com require_signed credit.paypal.com; |
|
17f21fcd44a8
allow quoted comma separated multiple signers in the dkim_from config entries
Carl Byington <carl@five-ten-sg.com>
parents:
322
diff
changeset
|
872 paypal.com require_signed paypal.com; |
|
17f21fcd44a8
allow quoted comma separated multiple signers in the dkim_from config entries
Carl Byington <carl@five-ten-sg.com>
parents:
322
diff
changeset
|
873 dhl.com require_signed dhl.com; |
|
17f21fcd44a8
allow quoted comma separated multiple signers in the dkim_from config entries
Carl Byington <carl@five-ten-sg.com>
parents:
322
diff
changeset
|
874 adp.com require_signed "adp.com,bmi.adp.com"; |
|
395
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
875 # |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
876 # blacklisting based on header from value - requiring signatures |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
877 # from an impossible signer. |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
878 spammer.domain require_signed " "; |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
879 # |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
880 # whitelisting based on strong spf pass - whitelisted if signed by |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
881 # an impossible signer (which will never happen) or strong spf pass. |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
882 some.domain signed_white " "; |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
883 # |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
884 # whitelisting based on valid signature or strong spf pass. |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
885 # some paychex mail is signed, some is unsigned but passes strong spf. |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
886 paychex.com require_signed paychex.com; |
|
a8cf6a3da907
document dkim/spf processing
Carl Byington <carl@five-ten-sg.com>
parents:
360
diff
changeset
|
887 # |
|
360
17f21fcd44a8
allow quoted comma separated multiple signers in the dkim_from config entries
Carl Byington <carl@five-ten-sg.com>
parents:
322
diff
changeset
|
888 }; |
| 108 | 889 filter sbl-xbl.spamhaus.org "Mail containing %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s"; |
|
270
f92f24950bd3
Use mozilla prefix list for tld checking, Enable surbl/uribl/dbl rhs lists
Carl Byington <carl@five-ten-sg.com>
parents:
268
diff
changeset
|
890 uribl multi.surbl.org "Mail containing %s rejected - surbl; see http://www.surbl.org/surbl-analysis?d=%s"; |
|
259
be939802c64e
add recipient rate limits by email from address or domain
Carl Byington <carl@five-ten-sg.com>
parents:
255
diff
changeset
|
891 #uribl multi.uribl.com "Mail containing %s rejected - uribl; see http://l.uribl.com/?d=%s"; |
|
270
f92f24950bd3
Use mozilla prefix list for tld checking, Enable surbl/uribl/dbl rhs lists
Carl Byington <carl@five-ten-sg.com>
parents:
268
diff
changeset
|
892 #uribl dbl.spamhaus.org "Mail containing %s rejected - dbl; see http://www.spamhaus.org/query/domain?domain=%s"; |
| 108 | 893 ignore { include "hosts-ignore.conf"; }; |
| 894 tld { include "tld.conf"; }; | |
| 895 html_tags { include "html-tags.conf"; }; | |
| 896 html_limit off; | |
| 897 host_limit soft 20; | |
| 178 | 898 spamassassin 5; |
| 899 require_match yes; | |
| 900 dcc_greylist yes; | |
| 901 dcc_bulk_threshold 20; | |
| 108 | 902 }; |
| 94 | 903 |
|
216
784030ac71f1
Never whitelist self addressed mail. Changes for Fedora 10 and const correctness.
Carl Byington <carl@five-ten-sg.com>
parents:
214
diff
changeset
|
904 generic "^dsl.static.*ttnet.net.tr$|(^|[x.-])(ppp|h|host)?([0-9]{1,3}[x.-](Red-|dynamic[x.-])?){4}" |
| 171 | 905 "your mail server %s seems to have a generic name"; |
| 906 | |
|
259
be939802c64e
add recipient rate limits by email from address or domain
Carl Byington <carl@five-ten-sg.com>
parents:
255
diff
changeset
|
907 white_regex "=example.com=user@yourhostingaccount.com$"; |
|
233
5c3e9bf45bb5
Add whitelisting by regex expression filtering.
Carl Byington <carl@five-ten-sg.com>
parents:
216
diff
changeset
|
908 |
| 108 | 909 env_to { |
| 171 | 910 # !! replace this with your domain names |
| 108 | 911 # child contexts are not allowed to specify recipient addresses outside these domains |
| 179 | 912 # if this is a backup-mx, you need to include here domains for which you relay to the primary mx |
| 174 | 913 include "/etc/mail/local-host-names"; |
| 108 | 914 }; |
| 94 | 915 |
| 108 | 916 context whitelist { |
| 917 content off {}; | |
| 918 env_to { | |
| 171 | 919 # dcc_to ok { include "/var/dcc/whitecommon"; }; |
| 108 | 920 }; |
| 921 env_from white {}; # white forces all unmatched from addresses (everyone in this case) to be whitelisted | |
| 922 # so all mail TO these env_to addresses is accepted | |
| 923 }; | |
| 94 | 924 |
| 171 | 925 context abuse { |
| 926 dnsbl_list xbl; | |
| 927 content off {}; | |
| 174 | 928 generic "^$ " " "; # regex cannot match, to disable generic rdns rejects |
| 171 | 929 env_to { |
| 930 abuse@ # no content filtering on abuse reports | |
| 931 postmaster@ # "" | |
| 932 }; | |
| 933 env_from unknown {}; # ignore all parent white/black listing | |
| 934 }; | |
| 935 | |
| 108 | 936 context minimal { |
| 171 | 937 dnsbl_list sbl; |
| 178 | 938 content on { |
| 939 spamassassin 10; | |
| 940 dcc_bulk_threshold many; | |
| 941 }; | |
| 171 | 942 generic "^$ " " "; # regex cannot match, to disable generic rdns rejects |
| 108 | 943 env_to { |
| 944 }; | |
| 945 }; | |
| 94 | 946 |
| 108 | 947 context blacklist { |
|
255
d6d5c50b9278
Allow dnswl_list and dnsbl_list to be empty, to override lists specified in the ancestor contexts. Add daily recipient limits as a multiple of the hourly limits.
Carl Byington <carl@five-ten-sg.com>
parents:
253
diff
changeset
|
948 dnsbl_list ; |
|
d6d5c50b9278
Allow dnswl_list and dnsbl_list to be empty, to override lists specified in the ancestor contexts. Add daily recipient limits as a multiple of the hourly limits.
Carl Byington <carl@five-ten-sg.com>
parents:
253
diff
changeset
|
949 dnswl_list ; |
| 108 | 950 env_to { |
| 171 | 951 # dcc_to many { include "/var/dcc/whitecommon"; }; |
| 108 | 952 }; |
| 953 env_from black {}; # black forces all unmatched from addresses (everyone in this case) to be blacklisted | |
| 954 # so all mail TO these env_to addresses is rejected | |
| 955 }; | |
| 94 | 956 |
| 171 | 957 env_from unknown { |
| 958 abuse@ abuse; # replies to abuse reports use the abuse context | |
| 959 # dcc_from { include "/var/dcc/whitecommon"; }; | |
| 108 | 960 }; |
| 961 | |
| 171 | 962 autowhite 90 "autowhite/my-auto-whitelist"; |
| 963 # install should create /etc/dnsbl/autowhite writable by userid dnsbl | |
| 108 | 964 };]]></literallayout> |
| 965 </refsect1> | |
| 94 | 966 |
| 111 | 967 <refsect1 id='version.5'> |
|
201
752d4315675c
add reference to mercurial repository in the documentation
Carl Byington <carl@five-ten-sg.com>
parents:
187
diff
changeset
|
968 <title>Version</title> |
| 108 | 969 <para> |
|
201
752d4315675c
add reference to mercurial repository in the documentation
Carl Byington <carl@five-ten-sg.com>
parents:
187
diff
changeset
|
970 @VERSION@ |
| 108 | 971 </para> |
| 972 </refsect1> | |
| 973 | |
| 974 </refentry> | |
| 975 </reference> |