Mercurial > dnsbl
annotate dnsbl.conf @ 172:d3189495ec68 stable-6-0-7
don't do generic rdns filtering on whitelisted recipients
| author | carl |
|---|---|
| date | Thu, 30 Aug 2007 18:50:00 -0700 |
| parents | 8deb51871b3d |
| children | da0c41b9f672 |
| rev | line source |
|---|---|
| 127 | 1 context main-default { |
| 2 // outbound dnsbl filtering to catch our own customers that end up on the sbl | |
| 136 | 3 dnsbl localp partial.blackholes.five-ten-sg.com "Mail from %s rejected - local; see http://www.five-ten-sg.com/blackhole.php?%s"; |
| 127 | 4 dnsbl local blackholes.five-ten-sg.com "Mail from %s rejected - local; see http://www.five-ten-sg.com/blackhole.php?%s"; |
| 5 dnsbl sbl sbl-xbl.spamhaus.org "Mail from %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s"; | |
| 171 | 6 dnsbl_list local sbl; |
| 127 | 7 |
| 8 // outbound content filtering to prevent our own customers from sending spam | |
| 9 content on { | |
| 10 filter sbl-xbl.spamhaus.org "Mail containing %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s"; | |
| 11 uribl multi.surbl.org "Mail containing %s rejected - surbl; see http://www.rulesemporium.com/cgi-bin/uribl.cgi?bl0=1&domain0=%s"; | |
| 12 #uribl black.uribl.com "Mail containing %s rejected - uribl; see http://l.uribl.com/?d=%s"; | |
| 13 ignore { include "hosts-ignore.conf"; }; | |
| 14 tld { include "tld.conf"; }; | |
| 15 cctld { include "cctld.conf"; }; | |
| 16 html_tags { include "html-tags.conf"; }; | |
| 17 html_limit on 20 "Mail containing excessive bad html tags rejected"; | |
| 18 html_limit off; | |
| 19 host_limit on 20 "Mail containing excessive host names rejected"; | |
| 20 host_limit soft 20; | |
| 163 | 21 spamassassin 4; |
| 127 | 22 }; |
| 23 | |
| 24 // backscatter prevention - don't send bounces for mail that we accepted but could not forward | |
| 25 // we only send bounces to our own customers | |
| 26 env_from unknown { | |
| 27 "<>" black; | |
| 28 }; | |
| 136 | 29 |
|
144
31ff00ea6bfb
allow parent/child to share a fully qualified env_to address
carl
parents:
140
diff
changeset
|
30 // hourly recipient rate limit by smtp auth client id |
| 140 | 31 rate_limit 30 { // default |
|
144
31ff00ea6bfb
allow parent/child to share a fully qualified env_to address
carl
parents:
140
diff
changeset
|
32 #fred 100; // override default limits |
|
31ff00ea6bfb
allow parent/child to share a fully qualified env_to address
carl
parents:
140
diff
changeset
|
33 #joe 10; // "" |
| 136 | 34 }; |
| 127 | 35 }; |
| 36 | |
| 94 | 37 context main { |
| 136 | 38 dnsbl localp partial.blackholes.five-ten-sg.com "Mail from %s rejected - local; see http://www.five-ten-sg.com/blackhole.php?%s"; |
| 94 | 39 dnsbl local blackholes.five-ten-sg.com "Mail from %s rejected - local; see http://www.five-ten-sg.com/blackhole.php?%s"; |
| 40 dnsbl sbl sbl-xbl.spamhaus.org "Mail from %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s"; | |
| 41 dnsbl xbl xbl.spamhaus.org "Mail from %s rejected - xbl; see http://www.spamhaus.org/query/bl?ip=%s"; | |
| 171 | 42 dnsbl_list local sbl; |
| 94 | 43 |
| 44 content on { | |
| 45 filter sbl-xbl.spamhaus.org "Mail containing %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s"; | |
| 122 | 46 uribl multi.surbl.org "Mail containing %s rejected - surbl; see http://www.rulesemporium.com/cgi-bin/uribl.cgi?bl0=1&domain0=%s"; |
| 119 | 47 #uribl black.uribl.com "Mail containing %s rejected - uribl; see http://l.uribl.com/?d=%s"; |
| 94 | 48 ignore { include "hosts-ignore.conf"; }; |
| 49 tld { include "tld.conf"; }; | |
| 119 | 50 cctld { include "cctld.conf"; }; |
| 51 html_tags { include "html-tags.conf"; }; | |
| 94 | 52 html_limit off; |
| 53 host_limit soft 20; | |
| 163 | 54 spamassassin 5; |
| 94 | 55 }; |
| 56 | |
|
172
d3189495ec68
don't do generic rdns filtering on whitelisted recipients
carl
parents:
171
diff
changeset
|
57 generic "(^|[.-])(h(ost|))?([0-9]{1,3}[.-](Red-|dynamic[.-])?){4}" |
| 168 | 58 "your mail server %s seems to have a generic name"; |
| 59 | |
| 94 | 60 env_to { |
|
100
63e8633abc34
allow empty env_to at global context to remove all restrictions on child contexts
carl
parents:
94
diff
changeset
|
61 # !! replace this with your domain names |
|
63e8633abc34
allow empty env_to at global context to remove all restrictions on child contexts
carl
parents:
94
diff
changeset
|
62 # child contexts are not allowed to specify recipient addresses outside these domains |
|
63e8633abc34
allow empty env_to at global context to remove all restrictions on child contexts
carl
parents:
94
diff
changeset
|
63 # or leave this empty to allow unrestricted child contexts |
|
63e8633abc34
allow empty env_to at global context to remove all restrictions on child contexts
carl
parents:
94
diff
changeset
|
64 # example.com; |
| 94 | 65 }; |
| 66 | |
| 67 context whitelist { | |
| 68 content off {}; | |
| 69 env_to { | |
| 70 # dcc_to ok { include "/var/dcc/whitecommon"; }; | |
| 71 }; | |
| 72 env_from white {}; # white forces all unmatched from addresses (everyone in this case) to be whitelisted | |
| 73 # so all mail TO these env_to addresses is accepted | |
| 74 }; | |
| 75 | |
| 76 context abuse { | |
| 77 dnsbl_list xbl; | |
| 78 content off {}; | |
| 79 env_to { | |
| 80 abuse@ # no content filtering on abuse reports | |
| 81 postmaster@ # "" | |
| 82 }; | |
| 83 env_from unknown {}; # ignore all parent white/black listing | |
| 84 }; | |
| 85 | |
| 86 context minimal { | |
| 171 | 87 dnsbl_list sbl; |
| 94 | 88 content on {}; |
| 171 | 89 generic "^$ " " "; # regex cannot match, to disable generic rdns rejects |
| 94 | 90 env_to { |
| 91 }; | |
| 92 }; | |
| 93 | |
| 94 context blacklist { | |
| 95 env_to { | |
| 96 # dcc_to many { include "/var/dcc/whitecommon"; }; | |
| 97 }; | |
| 98 env_from black {}; # black forces all unmatched from addresses (everyone in this case) to be blacklisted | |
| 99 # so all mail TO these env_to addresses is rejected | |
| 100 }; | |
| 101 | |
| 102 env_from unknown { | |
| 103 abuse@ abuse; # replies to abuse reports use the abuse context | |
| 104 # dcc_from { include "/var/dcc/whitecommon"; }; | |
| 105 }; | |
| 153 | 106 |
|
167
9b129ed78d7d
actually use spamassassin result, allow build without spam assassin, only call it if some recipient needs it.
carl
parents:
165
diff
changeset
|
107 autowhite 90 "autowhite/my-auto-whitelist"; |
|
9b129ed78d7d
actually use spamassassin result, allow build without spam assassin, only call it if some recipient needs it.
carl
parents:
165
diff
changeset
|
108 # install should create /etc/dnsbl/autowhite writable by userid dnsbl |
| 94 | 109 }; |
| 110 |