# $Id$
#
# lines start with a command token, following by argument tokens
# tokens are separated by spaces or tabs
#
#
# content:
#   second token is the dns suffix used for the actual lookups
#   third  token? is a string enclosed in single quotes, so it
#       is not really a token. This is the error message, with
#       up to two %s parameters for the url and the client ip
#       address.
#
# dnsbl:
#   second token is the name of this dnsbl
#   third  token is the dns suffix used for the actual lookups
#   fourth token? is a string enclosed in single quotes, so it
#       is not really a token. This is the error message, with
#       up to two %s parameters for the client ip address.
#
# dnsbl_list:
#   second token is the name of this list of dnsbls
#   subsequent tokes are the names of the previously defined dnsbls
#
# env_from:
#   second token is the name of this envelope-from-map. There will
#       generally be multiple lines with the same name.
#   third token is the envelope from value from the smtp conversation,
#       or just the domain part that follows the @ symbol.
#   fourth token is BLACK, WHITE, or the name of a previously defined
#       envelope-from-map. BLACK causes mail from this sender to be
#       rejected with "no such user". WHITE causes mail to be accepted
#       and the dns based lists are ignored. DEFAULT may be used to override
#       the contents of other maps that are copied into this map, and
#       set that sender back to the default (not white or black listed,
#       and subject to dnsbl lookups).
#
# env_to:
#   second token is the envelope recipient value from the smtp conversation,
#       or just the domain part that follows the @ symbol.
#   third token is the name of a dnsbl-list, or WHITE or BLACK.
#   fourth token is the name of an envelope-from-map, or WHITE or BLACK.
#
#   If either one is BLACK, mail to this recipient is rejected with
#   "no such user", and the dns lists are not checked.
#
#   If the envelope-from-map name is WHITE, mail to this recipient is accepted
#   and the dns lists are not checked.
#
#   If the envelope-from-map exists, the map is checked for the presence
#   of the sender. A WHITE or BLACK answer is definitive and the dns lists
#   are not checked.
#
#   If the dnsbl-list name is WHITE, the dns lists are not checked and the
#   mail is accepted. Otherwise, the dns lists are checked and the mail
#   is rejected if any list has an A record for the standard dns based
#   lookup scheme (reversed octets of the client followed by the dns suffix).
#
#
# include:
#   second token is the path name of the dnsbl milter config file to be
#   included.
#
#
# include_dcc:
#   second token is the name of an envelope-from-map (EMAP below).
#   third token is the path name of the dcc whiteclnt config file to be
#   included.
#       entries from the dcc config are mapped as:
#           ok                   -> WHITE (TAG below)
#           many                 -> BLACK (TAG below)
#           env_to               -> env_to xxx TAG
#           env_from             -> env_from EMAP xxx TAG TAG
#           substitute mail_host -> env_from EMAP xxx TAG TAG
#
#
#
##############################################
# define the dnsbls to use
#
#
content         sbl-xbl.spamhaus.org        'Mail containing %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s'
#
dnsbl   LOCAL   blackholes.five-ten-sg.com  'Mail from %s rejected - local; see http://www.five-ten-sg.com/blackhole.php?%s'
dnsbl   SPEWS   blackholes.spews.org        'Mail from %s rejected - spews; see http://www.spews.org/ask.cgi?x=%s'
dnsbl   SBL     sbl-xbl.spamhaus.org        'Mail from %s rejected - sbl; see http://www.spamhaus.org/query/bl?ip=%s'


##############################################
# define the (default and other) lists of dnsbls to use
#
dnsbl_list  DEFAULT LOCAL SPEWS SBL
dnsbl_list  SIMPLE  SBL
dnsbl_list  CUST1   SBL
dnsbl_list  CUST2   SPEWS SBL


##############################################
# define the (default and other) env_from maps
#
env_from    DEFAULT spammer@example.com     BLACK
env_from    DEFAULT yahoo.com               BLACK

# special list for the vp
env_from    TEST    dummy-token             DEFAULT # inherit the currently defined DEFAULT env_from mapping
env_from    TEST    nai.com                 BLACK   # the vp does not like nai
env_from    TEST    yahoo.com               DEFAULT # override the blacklisting of yahoo
env_from    TEST    mother@spammyisp.com    WHITE   # suppresses dnsbl checking


##############################################
# specify dnsbl_lists and env_from maps to use for specific recipients
#
env_to      abuse@mydomain.com      WHITE   WHITE       # no dnsbl, no env_from map
env_to      sales@mydomain.com      SIMPLE  NULL        # sbl only, no env_from map
env_to      vp@mydomain.com         DEFAULT TEST        # allow mail from mom
env_to      old-emp@mydomain.com    BLACK   BLACK       # return no such user even from backup mx machines


##############################################
# specify dnsbl_lists and env_from maps to use for clients domains
#
env_to      mydomain.com            DEFAULT DEFAULT
env_to      customer1.com           CUST1   CUST1       # all customer 1 domains use just sbl
env_to      customer1a.com          CUST1   CUST1
env_to      customer1b.com          CUST1   CUST1
env_to      customer2.com           CUST2   CUST2       # all customer 2 domains use spews and sbl
env_to      customer2a.com          CUST2   CUST2


##############################################
# you can also include nested config files
# file names are single tokens, no embedded blanks
#
include dnsbl.conf      # this will generate a recursive include file syslog error message


##############################################
#
# fetch the normal dcc whitelist file and put the entries into the DEFAULT
# envelope-from-map.  The ok/many tags in the DCC file turn into
# WHITE/BLACK entries when imported.  The env_to entries from the DCC
# config turn into env_to entries here, and are therefore global to all
# domains.  The assumption is that a client will only have whitelist
# env_to entries for their own domains, in their own dcc config file.  The
# env_from and substitute mail_host entries turn into env_from entries in
# the named (DEFAULT in this case) envelope-from-map.
#
#
include_dcc  DEFAULT /var/dcc/whitecommon
include_dcc  CUST1   /var/dcc/whitecommon.cust1
include_dcc  CUST2   /var/dcc/whitecommon.cust2