Mercurial > dnsbl

annotate dnsbl.conf @ 350:f4ca91f49cb6

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
author Carl Byington <carl@five-ten-sg.com>
date Mon, 26 Dec 2016 09:31:57 -0800
parents a4f2fda72422
children 1b7a785610f5
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
127
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
1 context main-default {
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
2 // outbound dnsbl filtering to catch our own customers that end up on the sbl
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
3 dnsbl sbl sbl-xbl.spamhaus.org "Mail from %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s";
174
da0c41b9f672 don't whitelist addresses with embedded spaces
carl
parents: 172
diff changeset
4 dnsbl_list sbl;
127
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
5
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
6 // outbound content filtering to prevent our own customers from sending spam
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
7 content on {
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
8 filter sbl-xbl.spamhaus.org "Mail containing %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s";
270
f92f24950bd3 Use mozilla prefix list for tld checking, Enable surbl/uribl/dbl rhs lists
Carl Byington <carl@five-ten-sg.com>
parents: 268
diff changeset
9 uribl multi.surbl.org "Mail containing %s rejected - surbl; see http://www.surbl.org/surbl-analysis?d=%s";
259
be939802c64e add recipient rate limits by email from address or domain
Carl Byington <carl@five-ten-sg.com>
parents: 255
diff changeset
10 #uribl multi.uribl.com "Mail containing %s rejected - uribl; see http://l.uribl.com/?d=%s";
270
f92f24950bd3 Use mozilla prefix list for tld checking, Enable surbl/uribl/dbl rhs lists
Carl Byington <carl@five-ten-sg.com>
parents: 268
diff changeset
11 #uribl dbl.spamhaus.org "Mail containing %s rejected - dbl; see http://www.spamhaus.org/query/domain?domain=%s";
127
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
12 ignore { include "hosts-ignore.conf"; };
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
13 tld { include "tld.conf"; };
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
14 html_tags { include "html-tags.conf"; };
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
15 html_limit on 20 "Mail containing excessive bad html tags rejected";
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
16 html_limit off;
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
17 host_limit on 20 "Mail containing excessive host names rejected";
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
18 host_limit soft 20;
178
d6531c702be3 embedded dcc filtering
carl
parents: 175
diff changeset
19 spamassassin 4;
d6531c702be3 embedded dcc filtering
carl
parents: 175
diff changeset
20 require_match yes;
d6531c702be3 embedded dcc filtering
carl
parents: 175
diff changeset
21 dcc_greylist yes;
d6531c702be3 embedded dcc filtering
carl
parents: 175
diff changeset
22 dcc_bulk_threshold 50;
127
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
23 };
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
24
278
368572c57013 add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents: 270
diff changeset
25 // backscatter prevention - do not send bounces for mail that we accepted but could not forward
127
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
26 // we only send bounces to our own customers
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
27 env_from unknown {
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
28 "<>" black;
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
29 };
136
f4746d8a12a3 add smtp auth rate limits
carl
parents: 127
diff changeset
30
278
368572c57013 add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents: 270
diff changeset
31 // hourly recipient rate limit by smtp auth client id, or unauthenticated mail from address
368572c57013 add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents: 270
diff changeset
32 // hourly unique ip addresses by smtp auth client id, or unauthenticated mail from address
368572c57013 add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents: 270
diff changeset
33 // default hourly rate limit is 30
368572c57013 add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents: 270
diff changeset
34 // daily rate limits are 4 times the hourly limit
368572c57013 add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents: 270
diff changeset
35 // default hourly unique ip addresses is 5
368572c57013 add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents: 270
diff changeset
36 // daily unique ip addresses are 4 times the hourly limit
368572c57013 add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents: 270
diff changeset
37 rate_limit 30 4 5 4 { // default
368572c57013 add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents: 270
diff changeset
38 fred 100 10; // override default limits
368572c57013 add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents: 270
diff changeset
39 joe 10 2; // ""
368572c57013 add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents: 270
diff changeset
40 "sam@somedomain.tld" 500 2;
368572c57013 add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents: 270
diff changeset
41 "@otherdomain.tld" 100 2;
136
f4746d8a12a3 add smtp auth rate limits
carl
parents: 127
diff changeset
42 };
127
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
43 };
2b1a4701e856 sendmail no longer guarantees <> wrapper on envelopes
carl
parents: 122
diff changeset
44
94
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
45 context main {
136
f4746d8a12a3 add smtp auth rate limits
carl
parents: 127
diff changeset
46 dnsbl localp partial.blackholes.five-ten-sg.com "Mail from %s rejected - local; see http://www.five-ten-sg.com/blackhole.php?%s";
94
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
47 dnsbl local blackholes.five-ten-sg.com "Mail from %s rejected - local; see http://www.five-ten-sg.com/blackhole.php?%s";
174
da0c41b9f672 don't whitelist addresses with embedded spaces
carl
parents: 172
diff changeset
48 dnsbl sbl zen.spamhaus.org "Mail from %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s";
94
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
49 dnsbl xbl xbl.spamhaus.org "Mail from %s rejected - xbl; see http://www.spamhaus.org/query/bl?ip=%s";
249
15bf4f68a0b2 Add dnswl support
Carl Byington <carl@five-ten-sg.com>
parents: 233
diff changeset
50 dnswl dnswl.org list.dnswl.org 2;
171
8deb51871b3d fix pre/post scripts in rpm spec file
carl
parents: 168
diff changeset
51 dnsbl_list local sbl;
249
15bf4f68a0b2 Add dnswl support
Carl Byington <carl@five-ten-sg.com>
parents: 233
diff changeset
52 dnswl_list dnswl.org;
268
f941563c2a95 Add require_rdns checking
Carl Byington <carl@five-ten-sg.com>
parents: 263
diff changeset
53 require_rdns yes;
94
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
54
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
55 content on {
322
9f8411f3919c add dkim white/black listing
Carl Byington <carl@five-ten-sg.com>
parents: 321
diff changeset
56 dkim_signer {
330
b5b93a7e1e6d ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents: 322
diff changeset
57 // we could add consumer facing domains like yahoo.com, aol.com, etc
b5b93a7e1e6d ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents: 322
diff changeset
58 // here, IF you really want to accept all the mail from such folks.
b5b93a7e1e6d ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents: 322
diff changeset
59 five-ten-sg.com white;
b5b93a7e1e6d ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents: 322
diff changeset
60 some.spammer black; // reject if signed by them
322
9f8411f3919c add dkim white/black listing
Carl Byington <carl@five-ten-sg.com>
parents: 321
diff changeset
61 };
9f8411f3919c add dkim white/black listing
Carl Byington <carl@five-ten-sg.com>
parents: 321
diff changeset
62
9f8411f3919c add dkim white/black listing
Carl Byington <carl@five-ten-sg.com>
parents: 321
diff changeset
63 dkim_from {
330
b5b93a7e1e6d ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents: 322
diff changeset
64 // cannot really add consumer facing domains like yahoo.com, aol.com, etc
b5b93a7e1e6d ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents: 322
diff changeset
65 // here, since such messages from humans might be sent via mailing lists
b5b93a7e1e6d ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents: 322
diff changeset
66 // that will break the dkim signature. But this works well for commonly
b5b93a7e1e6d ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents: 322
diff changeset
67 // forged bulk senders like ebay and paypal.
b5b93a7e1e6d ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents: 322
diff changeset
68 some.spammer require_signed some.spammer // reject if not signed
b5b93a7e1e6d ignore envelope-from based whitelisting if we have a dkim requirement for that domain
Carl Byington <carl@five-ten-sg.com>
parents: 322
diff changeset
69
350
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
70 123greetings.info require_signed 123greetings.info;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
71 aadvantage.email.aa.com require_signed aadvantage.email.aa.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
72 admarketing.yahoo.com require_signed admarketing.yahoo.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
73 adp.com require_signed adp.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
74 alertsp.chase.com require_signed alertsp.chase.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
75 allaboutjazz.com require_signed allaboutjazz.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
76 alpineescrow.net require_signed alpineescrowarrowhead.onmicrosoft.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
77 amazon.com require_signed amazon.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
78 applemusic.com require_signed applemusic.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
79 billpay.bankofamerica.com require_signed billpay.bankofamerica.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
80 booking.com require_signed sg.booking.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
81 cafepress.com require_signed cafepressinc.onmicrosoft.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
82 checkin.email.aa.com require_signed checkin.email.aa.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
83 connect.wellsfargoemail.com require_signed connect.wellsfargoemail.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
84 craigslist.org require_signed craigslist.org;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
85 dailykos.com require_signed sg.actionnetwork.org;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
86 daytimer.com require_signed daytimer.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
87 deals.priceline.com require_signed deals.priceline.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
88 dhl.com require_signed dhl.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
89 dropbox.com require_signed dropbox.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
90 dvd.com require_signed dvd.com
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
91 e.bevmo.com require_signed e.bevmo.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
92 e.bloomingdales.com require_signed e.bloomingdales.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
93 e.business.officedepot.com require_signed e.business.officedepot.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
94 e.shutterfly.com require_signed e.shutterfly.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
95 e.statefarm.com require_signed e.statefarm.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
96 e1.llbean.com require_signed e1.llbean.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
97 ealerts.bankofamerica.com require_signed ealerts.bankofamerica.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
98 easy.staples.com require_signed easy.staples.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
99 ebay.com require_signed ebay.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
100 ecommail.walgreens.com require_signed ecommail.walgreens.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
101 email.aa.com require_signed email.aa.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
102 email.aegeanair.com require_signed email.aegeanair.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
103 email.chase.com require_signed email.chase.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
104 email.consumerreports.org require_signed email.consumerreports.org;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
105 email.dowjones.com require_signed email.dowjones.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
106 email.homedepot.com require_signed email.homedepot.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
107 email.jetblue.com require_signed email.jetblue.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
108 email.ticketmaster.com require_signed email.ticketmaster.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
109 email.travelzoo.com require_signed email.travelzoo.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
110 email.wetransfer.com require_signed email.wetransfer.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
111 email.zazzle.com require_signed email.zazzle.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
112 email.zionlodge.com require_signed email.zionlodge.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
113 emails.cafepress.com require_signed cafepress.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
114 et.uber.com require_signed et.uber.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
115 facebookmail.com require_signed facebookmail.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
116 fedex.com require_signed fedex.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
117 harryanddavid-email.com require_signed harryanddavid-email.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
118 healthcare.gov require_signed healthcare.gov;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
119 imail.register.com require_signed imail.register.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
120 info1.networksolutions.com require_signed info1.networksolutions.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
121 insideapple.apple.com require_signed insideapple.apple.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
122 intuit.com require_signed intuit.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
123 lakearrowheadchamber.com require_signed lakearrowhead.ccsend.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
124 lehighvalleychamber.org require_signed lehighvalleychamber.ccsend.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
125 libertymutual.com require_signed libertymutual.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
126 linkedin.com require_signed linkedin.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
127 luv.southwest.com require_signed luv.southwest.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
128 mail.sling.com require_signed mail.sling.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
129 mail.zillow.com require_signed mail.zillow.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
130 mailer.box.com require_signed box.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
131 midjerseychamber.org require_signed midjerseychamber.ccsend.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
132 monster.com require_signed monster.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
133 my.orbitz.com require_signed my.orbitz.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
134 mystubhub.com require_signed mystubhub.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
135 na.email.aa.com require_signed na.email.aa.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
136 new.itunes.com require_signed new.itunes.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
137 news.united.com require_signed news.united.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
138 nextdayflyers.com require_signed nextdayflyers.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
139 notices.rei.com require_signed notices.rei.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
140 openemail.americanexpress.com require_signed openemail.americanexpress.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
141 orders.staples.com signed_white orders.staples.com; // some unsigned mail via protection.outlook.com
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
142 paychex.com require_signed paychex.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
143 paypal.com require_signed paypal.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
144 public.govdelivery.com require_signed public.govdelivery.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
145 r.groupon.com require_signed r.groupon.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
146 reply1.ebay.com require_signed reply1.ebay.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
147 response.nfcu.org require_signed response.nfcu.org;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
148 service.capitalone.com require_signed capitalone.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
149 service.checkout.visa.com require_signed service.checkout.visa.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
150 sg.booking.com require_signed sg.booking.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
151 subscriptions.ssa.gov require_signed subscriptions.ssa.gov;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
152 support.facebook.com require_signed support.facebook.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
153 support.zappos.com require_signed zappos.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
154 ticketfly.com require_signed ticketfly.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
155 twitter.com require_signed twitter.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
156 unionbank.com require_signed unionbank.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
157 ups.com require_signed ups.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
158 welcome.aexp.com require_signed welcome.aexp.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
159 wellsfargo.com require_signed wellsfargo.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
160 wetransfer.com require_signed email.wetransfer.com;
f4ca91f49cb6 send the original mail from address to the verify server, not the srs/pvrs unwrapped version; recognize our own dkim signatures
Carl Byington <carl@five-ten-sg.com>
parents: 334
diff changeset
161 zappos.com require_signed zappos.com;
322
9f8411f3919c add dkim white/black listing
Carl Byington <carl@five-ten-sg.com>
parents: 321
diff changeset
162 };
94
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
163 filter sbl-xbl.spamhaus.org "Mail containing %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s";
278
368572c57013 add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents: 270
diff changeset
164 uribl multi.surbl.org "Mail containing %s rejected - surbl; see http://www.surbl.org/surbl-analysis?d=%s";
259
be939802c64e add recipient rate limits by email from address or domain
Carl Byington <carl@five-ten-sg.com>
parents: 255
diff changeset
165 #uribl multi.uribl.com "Mail containing %s rejected - uribl; see http://l.uribl.com/?d=%s";
278
368572c57013 add limits on unique ip addresses per hour per authenticated user
Carl Byington <carl@five-ten-sg.com>
parents: 270
diff changeset
166 #uribl dbl.spamhaus.org "Mail containing %s rejected - dbl; see http://www.spamhaus.org/query/domain?domain=%s";
94
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
167 ignore { include "hosts-ignore.conf"; };
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
168 tld { include "tld.conf"; };
119
d9d2f8699621 uribl patch from Jeff Evans <jeffe@tricab.com>
carl
parents: 117
diff changeset
169 html_tags { include "html-tags.conf"; };
94
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
170 html_limit off;
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
171 host_limit soft 20;
178
d6531c702be3 embedded dcc filtering
carl
parents: 175
diff changeset
172 spamassassin 5;
d6531c702be3 embedded dcc filtering
carl
parents: 175
diff changeset
173 require_match yes;
d6531c702be3 embedded dcc filtering
carl
parents: 175
diff changeset
174 dcc_greylist yes;
d6531c702be3 embedded dcc filtering
carl
parents: 175
diff changeset
175 dcc_bulk_threshold 20;
94
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
176 };
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
177
298
4dd677e3b509 add linode.com to generic regex
Carl Byington <carl@five-ten-sg.com>
parents: 278
diff changeset
178 generic "^li.*members.linode.com$|^dsl.static.*ttnet.net.tr$|(^|[x.-])(ppp|h|host)?([0-9]{1,3}[x.-](Red-|dynamic[x.-])?){4}"
168
6bac960af6b4 add generic reverse dns filtering regex
carl
parents: 167
diff changeset
179 "your mail server %s seems to have a generic name";
6bac960af6b4 add generic reverse dns filtering regex
carl
parents: 167
diff changeset
180
233
5c3e9bf45bb5 Add whitelisting by regex expression filtering.
Carl Byington <carl@five-ten-sg.com>
parents: 216
diff changeset
181 white_regex "=example.com=user@yourhostingaccount.com$";
5c3e9bf45bb5 Add whitelisting by regex expression filtering.
Carl Byington <carl@five-ten-sg.com>
parents: 216
diff changeset
182
94
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
183 env_to {
100
63e8633abc34 allow empty env_to at global context to remove all restrictions on child contexts
carl
parents: 94
diff changeset
184 # !! replace this with your domain names
63e8633abc34 allow empty env_to at global context to remove all restrictions on child contexts
carl
parents: 94
diff changeset
185 # child contexts are not allowed to specify recipient addresses outside these domains
179
8b86a894514d embedded dcc filtering
carl
parents: 178
diff changeset
186 # if this is a backup-mx, you need to include here domains for which you relay to the primary mx
174
da0c41b9f672 don't whitelist addresses with embedded spaces
carl
parents: 172
diff changeset
187 include "/etc/mail/local-host-names";
94
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
188 };
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
189
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
190 context whitelist {
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
191 content off {};
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
192 env_to {
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
193 # dcc_to ok { include "/var/dcc/whitecommon"; };
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
194 };
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
195 env_from white {}; # white forces all unmatched from addresses (everyone in this case) to be whitelisted
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
196 # so all mail TO these env_to addresses is accepted
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
197 };
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
198
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
199 context abuse {
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
200 dnsbl_list xbl;
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
201 content off {};
174
da0c41b9f672 don't whitelist addresses with embedded spaces
carl
parents: 172
diff changeset
202 generic "^$ " " "; # regex cannot match, to disable generic rdns rejects
94
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
203 env_to {
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
204 abuse@ # no content filtering on abuse reports
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
205 postmaster@ # ""
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
206 };
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
207 env_from unknown {}; # ignore all parent white/black listing
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
208 };
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
209
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
210 context minimal {
171
8deb51871b3d fix pre/post scripts in rpm spec file
carl
parents: 168
diff changeset
211 dnsbl_list sbl;
178
d6531c702be3 embedded dcc filtering
carl
parents: 175
diff changeset
212 content on {
d6531c702be3 embedded dcc filtering
carl
parents: 175
diff changeset
213 spamassassin 10;
d6531c702be3 embedded dcc filtering
carl
parents: 175
diff changeset
214 dcc_bulk_threshold many;
d6531c702be3 embedded dcc filtering
carl
parents: 175
diff changeset
215 };
171
8deb51871b3d fix pre/post scripts in rpm spec file
carl
parents: 168
diff changeset
216 generic "^$ " " "; # regex cannot match, to disable generic rdns rejects
94
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
217 env_to {
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
218 };
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
219 };
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
220
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
221 context blacklist {
255
d6d5c50b9278 Allow dnswl_list and dnsbl_list to be empty, to override lists specified in the ancestor contexts. Add daily recipient limits as a multiple of the hourly limits.
Carl Byington <carl@five-ten-sg.com>
parents: 249
diff changeset
222 dnsbl_list ;
d6d5c50b9278 Allow dnswl_list and dnsbl_list to be empty, to override lists specified in the ancestor contexts. Add daily recipient limits as a multiple of the hourly limits.
Carl Byington <carl@five-ten-sg.com>
parents: 249
diff changeset
223 dnswl_list ;
94
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
224 env_to {
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
225 # dcc_to many { include "/var/dcc/whitecommon"; };
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
226 };
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
227 env_from black {}; # black forces all unmatched from addresses (everyone in this case) to be blacklisted
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
228 # so all mail TO these env_to addresses is rejected
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
229 };
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
230
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
231 env_from unknown {
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
232 abuse@ abuse; # replies to abuse reports use the abuse context
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
233 # dcc_from { include "/var/dcc/whitecommon"; };
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
234 };
153
8d7c439bb6fa add auto whitelisting
carl
parents: 144
diff changeset
235
167
9b129ed78d7d actually use spamassassin result, allow build without spam assassin, only call it if some recipient needs it.
carl
parents: 165
diff changeset
236 autowhite 90 "autowhite/my-auto-whitelist";
9b129ed78d7d actually use spamassassin result, allow build without spam assassin, only call it if some recipient needs it.
carl
parents: 165
diff changeset
237 # install should create /etc/dnsbl/autowhite writable by userid dnsbl
94
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
238 };
e107ade3b1c0 fix dos line terminators
carl
parents: 92
diff changeset
239