Mercurial > dnsbl
annotate dnsbl.conf @ 324:b6f173ac5209
add dkim white/black listing
author | Carl Byington <carl@five-ten-sg.com> |
---|---|
date | Sat, 17 Dec 2016 18:53:22 -0800 |
parents | 9f8411f3919c |
children | b5b93a7e1e6d |
rev | line source |
---|---|
127 | 1 context main-default { |
2 // outbound dnsbl filtering to catch our own customers that end up on the sbl | |
3 dnsbl sbl sbl-xbl.spamhaus.org "Mail from %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s"; | |
174 | 4 dnsbl_list sbl; |
127 | 5 |
6 // outbound content filtering to prevent our own customers from sending spam | |
7 content on { | |
8 filter sbl-xbl.spamhaus.org "Mail containing %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s"; | |
270
f92f24950bd3
Use mozilla prefix list for tld checking, Enable surbl/uribl/dbl rhs lists
Carl Byington <carl@five-ten-sg.com>
parents:
268
diff
changeset
|
9 uribl multi.surbl.org "Mail containing %s rejected - surbl; see http://www.surbl.org/surbl-analysis?d=%s"; |
259
be939802c64e
add recipient rate limits by email from address or domain
Carl Byington <carl@five-ten-sg.com>
parents:
255
diff
changeset
|
10 #uribl multi.uribl.com "Mail containing %s rejected - uribl; see http://l.uribl.com/?d=%s"; |
270
f92f24950bd3
Use mozilla prefix list for tld checking, Enable surbl/uribl/dbl rhs lists
Carl Byington <carl@five-ten-sg.com>
parents:
268
diff
changeset
|
11 #uribl dbl.spamhaus.org "Mail containing %s rejected - dbl; see http://www.spamhaus.org/query/domain?domain=%s"; |
127 | 12 ignore { include "hosts-ignore.conf"; }; |
13 tld { include "tld.conf"; }; | |
14 html_tags { include "html-tags.conf"; }; | |
15 html_limit on 20 "Mail containing excessive bad html tags rejected"; | |
16 html_limit off; | |
17 host_limit on 20 "Mail containing excessive host names rejected"; | |
18 host_limit soft 20; | |
178 | 19 spamassassin 4; |
20 require_match yes; | |
21 dcc_greylist yes; | |
22 dcc_bulk_threshold 50; | |
127 | 23 }; |
24 | |
278
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
270
diff
changeset
|
25 // backscatter prevention - do not send bounces for mail that we accepted but could not forward |
127 | 26 // we only send bounces to our own customers |
27 env_from unknown { | |
28 "<>" black; | |
29 }; | |
136 | 30 |
278
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
270
diff
changeset
|
31 // hourly recipient rate limit by smtp auth client id, or unauthenticated mail from address |
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
270
diff
changeset
|
32 // hourly unique ip addresses by smtp auth client id, or unauthenticated mail from address |
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
270
diff
changeset
|
33 // default hourly rate limit is 30 |
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
270
diff
changeset
|
34 // daily rate limits are 4 times the hourly limit |
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
270
diff
changeset
|
35 // default hourly unique ip addresses is 5 |
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
270
diff
changeset
|
36 // daily unique ip addresses are 4 times the hourly limit |
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
270
diff
changeset
|
37 rate_limit 30 4 5 4 { // default |
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
270
diff
changeset
|
38 fred 100 10; // override default limits |
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
270
diff
changeset
|
39 joe 10 2; // "" |
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
270
diff
changeset
|
40 "sam@somedomain.tld" 500 2; |
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
270
diff
changeset
|
41 "@otherdomain.tld" 100 2; |
136 | 42 }; |
127 | 43 }; |
44 | |
94 | 45 context main { |
136 | 46 dnsbl localp partial.blackholes.five-ten-sg.com "Mail from %s rejected - local; see http://www.five-ten-sg.com/blackhole.php?%s"; |
94 | 47 dnsbl local blackholes.five-ten-sg.com "Mail from %s rejected - local; see http://www.five-ten-sg.com/blackhole.php?%s"; |
174 | 48 dnsbl sbl zen.spamhaus.org "Mail from %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s"; |
94 | 49 dnsbl xbl xbl.spamhaus.org "Mail from %s rejected - xbl; see http://www.spamhaus.org/query/bl?ip=%s"; |
249 | 50 dnswl dnswl.org list.dnswl.org 2; |
171 | 51 dnsbl_list local sbl; |
249 | 52 dnswl_list dnswl.org; |
268
f941563c2a95
Add require_rdns checking
Carl Byington <carl@five-ten-sg.com>
parents:
263
diff
changeset
|
53 require_rdns yes; |
94 | 54 |
55 content on { | |
322
9f8411f3919c
add dkim white/black listing
Carl Byington <carl@five-ten-sg.com>
parents:
321
diff
changeset
|
56 dkim_signer { |
9f8411f3919c
add dkim white/black listing
Carl Byington <carl@five-ten-sg.com>
parents:
321
diff
changeset
|
57 sendgrid.me black; |
9f8411f3919c
add dkim white/black listing
Carl Byington <carl@five-ten-sg.com>
parents:
321
diff
changeset
|
58 weather.com white; |
9f8411f3919c
add dkim white/black listing
Carl Byington <carl@five-ten-sg.com>
parents:
321
diff
changeset
|
59 }; |
9f8411f3919c
add dkim white/black listing
Carl Byington <carl@five-ten-sg.com>
parents:
321
diff
changeset
|
60 |
9f8411f3919c
add dkim white/black listing
Carl Byington <carl@five-ten-sg.com>
parents:
321
diff
changeset
|
61 dkim_from { |
9f8411f3919c
add dkim white/black listing
Carl Byington <carl@five-ten-sg.com>
parents:
321
diff
changeset
|
62 yahoo.com require_signed yahoo.com; |
9f8411f3919c
add dkim white/black listing
Carl Byington <carl@five-ten-sg.com>
parents:
321
diff
changeset
|
63 gmail.com signed_white gmail.com; |
9f8411f3919c
add dkim white/black listing
Carl Byington <carl@five-ten-sg.com>
parents:
321
diff
changeset
|
64 girlscoutsla.org signed_white girlscoutsla.ccsend.com; |
9f8411f3919c
add dkim white/black listing
Carl Byington <carl@five-ten-sg.com>
parents:
321
diff
changeset
|
65 }; |
94 | 66 filter sbl-xbl.spamhaus.org "Mail containing %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s"; |
278
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
270
diff
changeset
|
67 uribl multi.surbl.org "Mail containing %s rejected - surbl; see http://www.surbl.org/surbl-analysis?d=%s"; |
259
be939802c64e
add recipient rate limits by email from address or domain
Carl Byington <carl@five-ten-sg.com>
parents:
255
diff
changeset
|
68 #uribl multi.uribl.com "Mail containing %s rejected - uribl; see http://l.uribl.com/?d=%s"; |
278
368572c57013
add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents:
270
diff
changeset
|
69 #uribl dbl.spamhaus.org "Mail containing %s rejected - dbl; see http://www.spamhaus.org/query/domain?domain=%s"; |
94 | 70 ignore { include "hosts-ignore.conf"; }; |
71 tld { include "tld.conf"; }; | |
119 | 72 html_tags { include "html-tags.conf"; }; |
94 | 73 html_limit off; |
74 host_limit soft 20; | |
178 | 75 spamassassin 5; |
76 require_match yes; | |
77 dcc_greylist yes; | |
78 dcc_bulk_threshold 20; | |
94 | 79 }; |
80 | |
298
4dd677e3b509
add linode.com to generic regex
Carl Byington <carl@five-ten-sg.com>
parents:
278
diff
changeset
|
81 generic "^li.*members.linode.com$|^dsl.static.*ttnet.net.tr$|(^|[x.-])(ppp|h|host)?([0-9]{1,3}[x.-](Red-|dynamic[x.-])?){4}" |
168 | 82 "your mail server %s seems to have a generic name"; |
83 | |
233
5c3e9bf45bb5
Add whitelisting by regex expression filtering.
Carl Byington <carl@five-ten-sg.com>
parents:
216
diff
changeset
|
84 white_regex "=example.com=user@yourhostingaccount.com$"; |
5c3e9bf45bb5
Add whitelisting by regex expression filtering.
Carl Byington <carl@five-ten-sg.com>
parents:
216
diff
changeset
|
85 |
94 | 86 env_to { |
100
63e8633abc34
allow empty env_to at global context to remove all restrictions on child contexts
carl
parents:
94
diff
changeset
|
87 # !! replace this with your domain names |
63e8633abc34
allow empty env_to at global context to remove all restrictions on child contexts
carl
parents:
94
diff
changeset
|
88 # child contexts are not allowed to specify recipient addresses outside these domains |
179 | 89 # if this is a backup-mx, you need to include here domains for which you relay to the primary mx |
174 | 90 include "/etc/mail/local-host-names"; |
94 | 91 }; |
92 | |
93 context whitelist { | |
94 content off {}; | |
95 env_to { | |
96 # dcc_to ok { include "/var/dcc/whitecommon"; }; | |
97 }; | |
98 env_from white {}; # white forces all unmatched from addresses (everyone in this case) to be whitelisted | |
99 # so all mail TO these env_to addresses is accepted | |
100 }; | |
101 | |
102 context abuse { | |
103 dnsbl_list xbl; | |
104 content off {}; | |
174 | 105 generic "^$ " " "; # regex cannot match, to disable generic rdns rejects |
94 | 106 env_to { |
107 abuse@ # no content filtering on abuse reports | |
108 postmaster@ # "" | |
109 }; | |
110 env_from unknown {}; # ignore all parent white/black listing | |
111 }; | |
112 | |
113 context minimal { | |
171 | 114 dnsbl_list sbl; |
178 | 115 content on { |
116 spamassassin 10; | |
117 dcc_bulk_threshold many; | |
118 }; | |
171 | 119 generic "^$ " " "; # regex cannot match, to disable generic rdns rejects |
94 | 120 env_to { |
121 }; | |
122 }; | |
123 | |
124 context blacklist { | |
255
d6d5c50b9278
Allow dnswl_list and dnsbl_list to be empty, to override lists specified in the ancestor contexts. Add daily recipient limits as a multiple of the hourly limits.
Carl Byington <carl@five-ten-sg.com>
parents:
249
diff
changeset
|
125 dnsbl_list ; |
d6d5c50b9278
Allow dnswl_list and dnsbl_list to be empty, to override lists specified in the ancestor contexts. Add daily recipient limits as a multiple of the hourly limits.
Carl Byington <carl@five-ten-sg.com>
parents:
249
diff
changeset
|
126 dnswl_list ; |
94 | 127 env_to { |
128 # dcc_to many { include "/var/dcc/whitecommon"; }; | |
129 }; | |
130 env_from black {}; # black forces all unmatched from addresses (everyone in this case) to be blacklisted | |
131 # so all mail TO these env_to addresses is rejected | |
132 }; | |
133 | |
134 env_from unknown { | |
135 abuse@ abuse; # replies to abuse reports use the abuse context | |
136 # dcc_from { include "/var/dcc/whitecommon"; }; | |
137 }; | |
153 | 138 |
167
9b129ed78d7d
actually use spamassassin result, allow build without spam assassin, only call it if some recipient needs it.
carl
parents:
165
diff
changeset
|
139 autowhite 90 "autowhite/my-auto-whitelist"; |
9b129ed78d7d
actually use spamassassin result, allow build without spam assassin, only call it if some recipient needs it.
carl
parents:
165
diff
changeset
|
140 # install should create /etc/dnsbl/autowhite writable by userid dnsbl |
94 | 141 }; |
142 |