Mercurial > dnsbl
annotate dnsbl.conf @ 270:f92f24950bd3 stable-6-0-35
Use mozilla prefix list for tld checking, Enable surbl/uribl/dbl rhs lists
| author | Carl Byington <carl@five-ten-sg.com> |
|---|---|
| date | Mon, 09 Sep 2013 15:15:53 -0700 |
| parents | f941563c2a95 |
| children | 368572c57013 |
| rev | line source |
|---|---|
| 127 | 1 context main-default { |
| 2 // outbound dnsbl filtering to catch our own customers that end up on the sbl | |
| 3 dnsbl sbl sbl-xbl.spamhaus.org "Mail from %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s"; | |
| 174 | 4 dnsbl_list sbl; |
| 127 | 5 |
| 6 // outbound content filtering to prevent our own customers from sending spam | |
| 7 content on { | |
| 8 filter sbl-xbl.spamhaus.org "Mail containing %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s"; | |
|
270
f92f24950bd3
Use mozilla prefix list for tld checking, Enable surbl/uribl/dbl rhs lists
Carl Byington <carl@five-ten-sg.com>
parents:
268
diff
changeset
|
9 uribl multi.surbl.org "Mail containing %s rejected - surbl; see http://www.surbl.org/surbl-analysis?d=%s"; |
|
259
be939802c64e
add recipient rate limits by email from address or domain
Carl Byington <carl@five-ten-sg.com>
parents:
255
diff
changeset
|
10 #uribl multi.uribl.com "Mail containing %s rejected - uribl; see http://l.uribl.com/?d=%s"; |
|
270
f92f24950bd3
Use mozilla prefix list for tld checking, Enable surbl/uribl/dbl rhs lists
Carl Byington <carl@five-ten-sg.com>
parents:
268
diff
changeset
|
11 #uribl dbl.spamhaus.org "Mail containing %s rejected - dbl; see http://www.spamhaus.org/query/domain?domain=%s"; |
| 127 | 12 ignore { include "hosts-ignore.conf"; }; |
| 13 tld { include "tld.conf"; }; | |
| 14 html_tags { include "html-tags.conf"; }; | |
| 15 html_limit on 20 "Mail containing excessive bad html tags rejected"; | |
| 16 html_limit off; | |
| 17 host_limit on 20 "Mail containing excessive host names rejected"; | |
| 18 host_limit soft 20; | |
| 178 | 19 spamassassin 4; |
| 20 require_match yes; | |
| 21 dcc_greylist yes; | |
| 22 dcc_bulk_threshold 50; | |
| 127 | 23 }; |
| 24 | |
| 25 // backscatter prevention - don't send bounces for mail that we accepted but could not forward | |
| 26 // we only send bounces to our own customers | |
| 27 env_from unknown { | |
| 28 "<>" black; | |
| 29 }; | |
| 136 | 30 |
|
259
be939802c64e
add recipient rate limits by email from address or domain
Carl Byington <carl@five-ten-sg.com>
parents:
255
diff
changeset
|
31 // hourly recipient rate limit by smtp auth client id, |
|
be939802c64e
add recipient rate limits by email from address or domain
Carl Byington <carl@five-ten-sg.com>
parents:
255
diff
changeset
|
32 // or unauthenticated mail from address |
|
255
d6d5c50b9278
Allow dnswl_list and dnsbl_list to be empty, to override lists specified in the ancestor contexts. Add daily recipient limits as a multiple of the hourly limits.
Carl Byington <carl@five-ten-sg.com>
parents:
249
diff
changeset
|
33 // default hourly limit is 30 |
|
d6d5c50b9278
Allow dnswl_list and dnsbl_list to be empty, to override lists specified in the ancestor contexts. Add daily recipient limits as a multiple of the hourly limits.
Carl Byington <carl@five-ten-sg.com>
parents:
249
diff
changeset
|
34 // daily limits are 4 times the hourly limit |
|
d6d5c50b9278
Allow dnswl_list and dnsbl_list to be empty, to override lists specified in the ancestor contexts. Add daily recipient limits as a multiple of the hourly limits.
Carl Byington <carl@five-ten-sg.com>
parents:
249
diff
changeset
|
35 rate_limit 30 4 { // default |
|
144
31ff00ea6bfb
allow parent/child to share a fully qualified env_to address
carl
parents:
140
diff
changeset
|
36 #fred 100; // override default limits |
|
31ff00ea6bfb
allow parent/child to share a fully qualified env_to address
carl
parents:
140
diff
changeset
|
37 #joe 10; // "" |
|
263
e118fd2c6af0
fix unauthenticated rate limit bug for empty mail from; move unauthenticate rate limit checks after spam filtering
Carl Byington <carl@five-ten-sg.com>
parents:
259
diff
changeset
|
38 #"sam@somedomain.tld" 500; |
|
e118fd2c6af0
fix unauthenticated rate limit bug for empty mail from; move unauthenticate rate limit checks after spam filtering
Carl Byington <carl@five-ten-sg.com>
parents:
259
diff
changeset
|
39 #"@otherdomain.tld" 100; |
| 136 | 40 }; |
| 127 | 41 }; |
| 42 | |
| 94 | 43 context main { |
| 136 | 44 dnsbl localp partial.blackholes.five-ten-sg.com "Mail from %s rejected - local; see http://www.five-ten-sg.com/blackhole.php?%s"; |
| 94 | 45 dnsbl local blackholes.five-ten-sg.com "Mail from %s rejected - local; see http://www.five-ten-sg.com/blackhole.php?%s"; |
| 174 | 46 dnsbl sbl zen.spamhaus.org "Mail from %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s"; |
| 94 | 47 dnsbl xbl xbl.spamhaus.org "Mail from %s rejected - xbl; see http://www.spamhaus.org/query/bl?ip=%s"; |
| 249 | 48 dnswl dnswl.org list.dnswl.org 2; |
| 171 | 49 dnsbl_list local sbl; |
| 249 | 50 dnswl_list dnswl.org; |
|
268
f941563c2a95
Add require_rdns checking
Carl Byington <carl@five-ten-sg.com>
parents:
263
diff
changeset
|
51 require_rdns yes; |
| 94 | 52 |
| 53 content on { | |
| 54 filter sbl-xbl.spamhaus.org "Mail containing %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s"; | |
| 122 | 55 uribl multi.surbl.org "Mail containing %s rejected - surbl; see http://www.rulesemporium.com/cgi-bin/uribl.cgi?bl0=1&domain0=%s"; |
|
259
be939802c64e
add recipient rate limits by email from address or domain
Carl Byington <carl@five-ten-sg.com>
parents:
255
diff
changeset
|
56 #uribl multi.uribl.com "Mail containing %s rejected - uribl; see http://l.uribl.com/?d=%s"; |
| 94 | 57 ignore { include "hosts-ignore.conf"; }; |
| 58 tld { include "tld.conf"; }; | |
| 119 | 59 html_tags { include "html-tags.conf"; }; |
| 94 | 60 html_limit off; |
| 61 host_limit soft 20; | |
| 178 | 62 spamassassin 5; |
| 63 require_match yes; | |
| 64 dcc_greylist yes; | |
| 65 dcc_bulk_threshold 20; | |
| 94 | 66 }; |
| 67 | |
|
216
784030ac71f1
Never whitelist self addressed mail. Changes for Fedora 10 and const correctness.
Carl Byington <carl@five-ten-sg.com>
parents:
179
diff
changeset
|
68 generic "^dsl.static.*ttnet.net.tr$|(^|[x.-])(ppp|h|host)?([0-9]{1,3}[x.-](Red-|dynamic[x.-])?){4}" |
| 168 | 69 "your mail server %s seems to have a generic name"; |
| 70 | |
|
233
5c3e9bf45bb5
Add whitelisting by regex expression filtering.
Carl Byington <carl@five-ten-sg.com>
parents:
216
diff
changeset
|
71 white_regex "=example.com=user@yourhostingaccount.com$"; |
|
5c3e9bf45bb5
Add whitelisting by regex expression filtering.
Carl Byington <carl@five-ten-sg.com>
parents:
216
diff
changeset
|
72 |
| 94 | 73 env_to { |
|
100
63e8633abc34
allow empty env_to at global context to remove all restrictions on child contexts
carl
parents:
94
diff
changeset
|
74 # !! replace this with your domain names |
|
63e8633abc34
allow empty env_to at global context to remove all restrictions on child contexts
carl
parents:
94
diff
changeset
|
75 # child contexts are not allowed to specify recipient addresses outside these domains |
| 179 | 76 # if this is a backup-mx, you need to include here domains for which you relay to the primary mx |
| 174 | 77 include "/etc/mail/local-host-names"; |
| 94 | 78 }; |
| 79 | |
| 80 context whitelist { | |
| 81 content off {}; | |
| 82 env_to { | |
| 83 # dcc_to ok { include "/var/dcc/whitecommon"; }; | |
| 84 }; | |
| 85 env_from white {}; # white forces all unmatched from addresses (everyone in this case) to be whitelisted | |
| 86 # so all mail TO these env_to addresses is accepted | |
| 87 }; | |
| 88 | |
| 89 context abuse { | |
| 90 dnsbl_list xbl; | |
| 91 content off {}; | |
| 174 | 92 generic "^$ " " "; # regex cannot match, to disable generic rdns rejects |
| 94 | 93 env_to { |
| 94 abuse@ # no content filtering on abuse reports | |
| 95 postmaster@ # "" | |
| 96 }; | |
| 97 env_from unknown {}; # ignore all parent white/black listing | |
| 98 }; | |
| 99 | |
| 100 context minimal { | |
| 171 | 101 dnsbl_list sbl; |
| 178 | 102 content on { |
| 103 spamassassin 10; | |
| 104 dcc_bulk_threshold many; | |
| 105 }; | |
| 171 | 106 generic "^$ " " "; # regex cannot match, to disable generic rdns rejects |
| 94 | 107 env_to { |
| 108 }; | |
| 109 }; | |
| 110 | |
| 111 context blacklist { | |
|
255
d6d5c50b9278
Allow dnswl_list and dnsbl_list to be empty, to override lists specified in the ancestor contexts. Add daily recipient limits as a multiple of the hourly limits.
Carl Byington <carl@five-ten-sg.com>
parents:
249
diff
changeset
|
112 dnsbl_list ; |
|
d6d5c50b9278
Allow dnswl_list and dnsbl_list to be empty, to override lists specified in the ancestor contexts. Add daily recipient limits as a multiple of the hourly limits.
Carl Byington <carl@five-ten-sg.com>
parents:
249
diff
changeset
|
113 dnswl_list ; |
| 94 | 114 env_to { |
| 115 # dcc_to many { include "/var/dcc/whitecommon"; }; | |
| 116 }; | |
| 117 env_from black {}; # black forces all unmatched from addresses (everyone in this case) to be blacklisted | |
| 118 # so all mail TO these env_to addresses is rejected | |
| 119 }; | |
| 120 | |
| 121 env_from unknown { | |
| 122 abuse@ abuse; # replies to abuse reports use the abuse context | |
| 123 # dcc_from { include "/var/dcc/whitecommon"; }; | |
| 124 }; | |
| 153 | 125 |
|
167
9b129ed78d7d
actually use spamassassin result, allow build without spam assassin, only call it if some recipient needs it.
carl
parents:
165
diff
changeset
|
126 autowhite 90 "autowhite/my-auto-whitelist"; |
|
9b129ed78d7d
actually use spamassassin result, allow build without spam assassin, only call it if some recipient needs it.
carl
parents:
165
diff
changeset
|
127 # install should create /etc/dnsbl/autowhite writable by userid dnsbl |
| 94 | 128 }; |
| 129 |