6.74 2018-12-24
    add debug code for spf check with microsoft /14

6.73 2018-09-18
    ignore dnswl entries if the sender is <>
    allow autowhite of recipients with local parts up to 35 characters.

6.72 2018-06-06
    add unsigned_black for enforcement of dmarc policy.

6.69 2018-04-10
    fix spf mx:domain.tld token parsing.

6.68 2018-02-19
    round rather than truncate spam assassin scores.
    check >= rather than > for spam assassin scores to match
    behavior of dcc bulk scores.

6.67 2018-01-05
    always call dcc code so we get log entries

6.66 2017-12-07
    more changes for long syslog messages

6.65 2017-11-03
    code cleanup

6.64 2017-11-03
    fix syslog for long messages
    supress dkim checks for mail from localhost

6.63 2017-10-24
    allow syslogging of long txt records

6.62 2017-10-03
    include arpa/nameser.h earlier.

6.61 2017-10-02
    allow 4000 byte spf txt records.

6.60 2017-08-18
    hosts-ignore.conf can be used to ignore nameserver names

6.59 2017-07-26
    use both envelope from and header from for spf checks when envelope from
    is a subdomain of the header from domain.

6.58 2017-05-19
    spf code now handles %{d} and %{h} macros.
    use envelope from value for spf if it is a subdomain of the header from domain.

6.57 2017-04-25
    spf code now handles mx,exists,ptr tags, multiple A records,
    %{i} macro

6.56 2017-04-19
    refactor spf code; allow wildcard *.example.com in dkim
    signing restrictions

6.55 2017-04-16
    require 3 dots in bare ip addresses.

6.54 2017-03-30
    document dmarc vs dnsbl dkim/spf. switch to . rather than
    " " for dkim impossible signer.

6.53 2017-03-17
    suppress duplicate calls to acceptable_content for
    messages with multiple recipients using the same filtering
    context. handle redirect= elements in spf txt records

6.52 2017-03-09
    document dkim/spf processing, handle a and a: elements

6.51 2017-03-06
    parse spf txt records for required dkim signers

6.50 2017-02-22
    reject if dkim signer is listed on surbl

6.49 2017-02-08
    RHEL7 systemd and /var/run on tmpfs.

6.48 2016-12-17
    Add dkim white/black listing

6.47 2016-09-21
    Better smtp verify logging

6.46 2016-09-19
    Enable smtp verify logging

6.45 2015-04-09
    Add bitcoin donation address

6.44 2014-10-13
    Generic regex now matches against the reverse dns PTR value

6.43 2014-07-18
    Allow broken SRS0+ rather than the correct SRS0= tag.

6.42 2014-06-28
    Never add auto-whitelist entries for outgoing mail from localhost.

6.41 2014-03-21
    Unique ip connection limits only apply to authenticated connections.

6.40 2014-02-05
    Fix possible segfault in mlfi_connect, hostaddr might be null.

6.39 2013-12-31
    Fix segfault caused by freeing unallocated memory.

6.38 2013-12-24
    Activate check for unique ip connection limits.

6.37 2013-12-17
    Add unique ip connection limits per authenticated id or email address.

6.36 2013-09-09
    Code cleanup, increase minimum hostname length for uribl checking.

6.35 2013-09-09
    Use mozilla prefix list for tld checking.
    Enable surbl/uribl/dbl rhs lists.

6.34 2013-05-22
    Add require_rdns checking.

6.33 2012-07-21
    Fix unauthenticated rate limit bug for empty mail from.
    Move unauthenticated rate limit checks after spam filtering.

6.32 2012-07-21
    Allow rate limiting for unauthentication connections by mail
    from address or domain.

6.31 2012-07-01
    Fix uribl lookups on client dns name, need to strip the ip
    address in brackets.

6.30 2012-04-09
    Allow dnswl_list and dnsbl_list to be empty, to override lists
    specified in the ancestor contexts.
    Add daily recipient limits as a multiple of the hourly limits.

6.29 2012-04-08
    Add dnswl support.

6.28 2011-09-30
    Add prvs decoding to envelope addresses.

6.27 2011-08-15
    const correctness fixes from new gcc

6.26 2010-11-19
    64 bit fixes for libresolv.a

6.25 2009-09-29
    Add surbl checks on the smtp helo value, client reverse dns name,
    and mail from domain name.

6.24 2009-06-09
    Add SRS decoding to envelope addresses.

6.23 2009-05-25
    Add whitelisting by regex expression filtering.
    Add queueid to whitelist extension log message.

6.22 2009-05-08
    Prevent auto whitelisting due to outgoing multipart/report
    delivery notifications.
    Fix memory leak in suppressed auto whitelisting.

6.21 2009-01-03
    Fixes to compile on old systems without memrchr or string::clear().
    Fix bug in spamassassin interface trying to clear a string with
    string::empty().

6.20 2008-12-27
    Never whitelist self addressed mail. Spammers are once again
    sending mail from A to A trying to get around filters. Changes
    for Fedora 10 and const correctness.

6.19 2008-06-10
    Fixes to compile on Fedora 9 and for const correctness.

6.18 2008-03-22
    Extend auto-whitelisting when receiving mail even if the auto
    whitelist is specified in a parent context. Fixes for Solaris from sm-archive.

6.17 2008-03-04
    Verify from/to pairs even if they might be explicitly whitelisted.
    Document DCC greylisting and bulk detection usage. Fix DCC bulk
    thresholds of many. Update spec file for fedora packaging.

6.16 2008-02-02
    Switch to Mercurial source control.

6.15 2007-12-07
    Fix null pointer dereference if macro _ not passed to this milter.
    Default sendmail config passes that in the connect call.

6.14 2007-11-11
    Delay auto whitelisting until we see the headers, to prevent
    auto whitelisting due to bulk out of office reply bots.

6.13 2007-11-10
    HELO command is optional, and if missing caused a null pointer
    dereference. Use smfi_progress in libmilter if it is available.

6.12 2007-10-13
    SMTP rejections take precedence over greylisting.

6.11 2007-10-07
    Add DCC filtering via dccifd. Drop to 60 seconds the time we will
    keep idle smtp verify sockets around. This needs to be about half
    the value of confTO_COMMAND configured on the verify targets.
    Fix potential race condition or buffer overflow caused by static
    buffer referenced by multiple threads.

6.10 2007-09-23
    Don't whitelist addresses with embedded blanks, or the empty
    path. Allow manual removal of auto whitelist entries.

6.09 2007-09-06
    Fix memory leak in auto-whitelisting code. Update auto-whitelist
    timestamps when receiving mail from auto-whitelisted senders.

6.08 2007-08-30
    Don't do generic reverse dns filtering on authenticated connections.

6.07 2007-08-30
    Add generic reverse dns filtering with regular expression.
    Fix pre/post scripts in the rpm spec file.

6.06 2007-08-27
    Fix bug that effectively disabled spamassassin filtering. Improve
    spamassassin filtering documentation. Generate warning if the
    config file specifies spam assassin filtering, but spamc is not
    found by autoconf.

6.05 2007-08-26
    Fix unitialized variable in my spamassassin code.

6.04 2007-08-26
    Add spamassassin integration via spamc, code from spamass-milter.

6.03 2007-07-14
    Don't add auto whitelist entries for our own domains.

6.02 2007-07-10
    Allow manual updates to the auto whitelisting files, mainly for
    scp or rsync synchronization between primary and backup mx
    systems.

6.01 2007-07-07
    GPL3. Block mail to recipients that cannot reply. Start auto
    whitelisting.

5.30 2007-06-09
    Selinux fix - redirect stdout for useradd to make selinux happy.

5.29 2007-03-27
    Limit dns resolver to two retries five seconds apart.

5.28 2007-02-19
    Change the conflict resolution algorithm to "second one wins" if we
    have two contexts that both define env_to user@.  Update ICANN tld
    list.

5.27 2007-01-30
    Allow 'inherit' as an env_from target. Documentation cleanup
    from G.W. Haywood.

5.26 2006-12-04
    Fix bug in content filtering introduced in 5.23 that prevented
    seeing any host names in the body.

5.25 2006-10-15
    DNSBL lists are inherited, so dump the effective list with the
    -c switch.

5.24 2006-10-15
    Allow child and parent context to specify the same fully qualified
    env_to address. Only dump the rate limit for the default context
    with -c switch.

5.23 2006-10-10
    Require two periods in ip addresses.

5.22 2006-09-27
    Change syntax for default rate limit. Improve hourly reset of
    limits. Warning for rate limits in non default contexts to allow
    nesting of client configurations.

5.21 2006-09-26
    Add SMTP AUTH recipient rate limits, to help throttle infected
    client machines and accounts with weak cracked passwords.

5.20 2006-08-02
    Fully qualify all dns lookups.  Fix my_read() bug.  Try to convert
    names that might be ip addresses via inet_aton before doing dns
    lookups.

5.19 2006-08-01
    Bug fix - add trailing dot to uribl dns lookups to make them fully
    qualified.  Check host names with only two components, since
    spammers are now using bare http://domain.tld references.
    Spec file now creates an rpm that properly creates the dnsbl user.

5.18 2006-04-27
    Bug fix - newer sendmail versions don't guarantee envelope addresses
    enclosed in <> wrapper.

    Document backscatter prevention configuration for systems that are
    used to mainly spam filter and then forward to mail to the internal
    server.

    Never ask uribl blacklists about rfc1918 address space.

5.17 2006-03-25
    Never ask dns blacklists about rfc1918 address space.

5.16 2006-03-16
    Bug fix - the smtp error message for uribl filtering needs to
    reference the host name, not the ip address.

5.15 2006-03-15
    Bug fix - we failed to properly set the return code to indicate the
    reason when rejecting mail for content filtering.

5.14 2006-03-13
    Fix a typo in the default config file and documentation for using
    multi.surbl.org

5.13 2006-03-12
    patch from Jeff Evans <jeffe@tricab.com>
        add SURBL/URIBL lookups, remove trailing dots from hostnames,
        allow ip address literals as hostnames.
    add configuration for surbl/uribl list and reject message

5.12 2006-01-08
    Use larger resolver buffer to accomodate spammers with many name
    servers.  A current example is life-all.com which needs to retry in
    tcp mode to fetch the 1444 byte response.

    'make chkconfig' now creates the dnsbl user if it does not exist.

5.11 2005-12-20
    switch to autoconf/automake/docbook

5.10 2005-10-16
    Fix a compile error on Fedora Core 3.
    Discovered by Nigel Horne <njh@bandsman.co.uk>

5.9 2005-09-26
    Fix a bug with empty return paths passed to the verification code.
    That resulted in 'MAIL FROM:<<>>' being sent to the verification
    mail server.

5.8 2005-09-25
    Allow empty env_to at global context level to remove restrictions
    on env_to values in child contexts.

5.7 2005-09-23
    Failed to return a value from parse_verify() which caused failures
    to load the configuration.

5.6 2005-09-22
    Tokenizer errors now go thru the syslog code, so they are visible
    when generated during config file reloads during normal operation.

5.5 2005-09-21
    Cleanup debug logging.  Verify from/to pairs now remembers the last
    from value sent to the remote server to prevent unnecessary rset
    commands.

5.4 2005-09-18
    Add verify statement to specify the smtp host to be used to verify
    envelope from / recipient pairs.

    Authenticated clients are now exempt from all white/black listing
    in addition to the dnsbl lookups.

    dcc_to should not look at substitute mail_host. That is only used
    by dcc_from.

5.3 2005-08-07
    Properly quit if the config file has syntax errors on startup.  Send
    mail to root if the config file needs to be reloaded since it was
    modified, but contains syntax errors.  In this case, we continue to
    use the old configuration.

5.2 2005-08-02
    Patch from Stephen Johnson <stephen.johnson@arkansas.gov> fixing the
    lack of a default return value in CONTEXT::acceptable_content().

5.1 2005-07-20
    Add multiple syslog debug levels.  Detect and silently remove
    duplicate DNSBL definitions.  That allows us to accept mail to
    recipients in multiple domains that use the same blacklist and yet
    only check that blacklist once.  This may happen when your config
    file directly includes as child contexts the config files used on
    your clients mail servers.

5.0 2005-07-16
    Major changes to the syntax of the config file.  Content filtering
    is no longer a global mail server setting.

4.6 2005-04-02
    Fix enum compilation error on Fedora Core 3.
    Discovered by Nigel Horne <njh@bandsman.co.uk>

    Remove bad html tag command from the default conf file.  Spammers
    seem to have abandoned this.

    Add toolbar.msn.click-url.com in hosts-ignore.conf.  These are all
    commented, but you might want to uncomment them.

4.5 2005-01-22
    Add uuencode decoding for old style attachments.

4.4 2005-01-18
    Bug fix in forked process termination that left zombies.

4.3 2005-01-16
    Only keep 20% of the resolver sockets in the ready pool.

4.2 2005-01-08
    Use the separate resolver processes even if we don't have the
    resolver interfaces and need gethostbyname.

4.1 2005-01-06
    Use a local unix domain socket for the resolver process
    communication, rather than a tcp/ip socket.

4.0 2005-01-03
    Initialize the thread mutex objects early, before they are needed
    by possible calls to my_syslog.

    Fork off a separate resolver listener process, so we can do multiple
    dns operations in parallel. For each simultaneous inbound email,
    we have a separate sendmail process, a milter thread, and a dns
    resolver process.

3.7 2004-10-28
    Added an 'ignore' command to the conf file, used to ignore some
    hosts that might end up on the SBL and otherwise trip the content
    scanning filter.  In particular, many recent Microsoft Word
    documents contain the string www.5iantlavalamp.com which is
    associated with their smart tags stuff.  That is currently hosted at
    216.168.224.70, which is shared with a site that ended up on the
    SBL.

3.6 2004-09-08
    Contributions from Dan Harkless <software@harkless.org>
        Better documentation for disabling the content filtering.
        Don't bother looking at the body text if we are not doing
        content filtering.

3.5 2004-07-17
    Extend the error message for content filtering when the NS record
    points to an ip address on the SBL.  Include the original host name
    that referenced that NS name.


3.4 2004-07-15
    Tokens with two consecutive periods cannot be ip addresses or host
    names.

    Updated dnsbl.spec file for building rpms from John Gunkel.


3.3 2004-07-09
    Drop root priviledges properly, including the group id.


3.2 2004-07-09

    Contributions from John Gunkel <jgunkel@palliser.ca>:
        Add .spec file for building rpms, contributed by John Gunkel

        Changes to file layout to conform to RedHat/LSB standards.

        Add some html (actually xml) tags used by Apple mac print
        subsystem that were tripping the html tag detector.

        Help with changes required to allow dnsbl to drop root
        priviledges. Move the socket to /var/run/dnsbl/dnsbl.sock

    Change parser to handle &#xnnn; obfuscated urls with charaters
    specified in hex.

    Make bad_html tags more sensitive to binary tags, to reduce false
    positives in .zip or .tar.gz file attachments.

    Add sendmail queueid to the dnsbl syslog messages.

    Fix one place where host names were not forced to lower case.
    Discovered by Nigel Horne <njh@bandsman.co.uk>

    Remove duplicate dns queries within the same smtp transaction from
    the body content filtering.  This helps if the mail server does not
    have a nearby caching dns server.

    Add host_soft_limit config keyword.  Use only one of host_limit or
    host_soft_limit, since the last one wins.  The host_limit is a hard
    upper limit on the number of host names in a message.  The
    host_soft_limit allows unlimited host names, but only checks a
    random sample of them against the dnsbl.

    The main thread has dropped root priviledges, but other threads
    are still running as root. This needs to be fixed.