Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Can anyone help me with constructing sendmail rules for limiting spam? Assuming that name of my domain is my.domain.com, I want to use following rules:

  1. If BOTH sender and recipient address is from my.domain.com, message should be rejected (sendmail server only relays messages between my internal exchange server and outside word, so sending messages between users from my.domain.com always occour on exchange server and never on sendmail server)

  2. If recipient list contains AT LAST ONE invalid address, whole message should be rejected (even for valid recipients addresses)

  3. If sending server uses HELO message with bogus domain name (other than domain of this server), message should be rejected

  4. Any server attempting to send mail to dedicated address (f.e. mail_trap@my.domain.com), should be automatically blacklisted

  5. Any other suggested rules ...

share|improve this question
add comment

3 Answers

up vote 0 down vote accepted

If you want to run MIMEDefang together with sendmai you can do most of what you write by providing the appropriate routines in mimedefang-filter. However, your best approach would be to use SpamAssassin first and then see what more filters you can implement yourself. SpamAssassin can be executed via MIMEDefang which means you can combine it with custom rules of your own.

share|improve this answer
    
Ok, so could you point me to any site with good docs/tutorials/exaples about using spamassasin together with MIMEDefang? –  user71061 Mar 2 '11 at 16:11
    
There's really nothing much to it. Assuming a Debian install you apt-get install mimedefang spamassassin (You may even want to install ClamAV too). Then to enable SpamAssassin via MIMEDefang you edit mimedefang.pl.conf. SpamAssassin specific configuration goes to sa-mimedefang.cf See also this mickeyhill.com/mimedefang-howto –  adamo Mar 2 '11 at 21:05
    
Ok, thank you for your help. –  user71061 Mar 2 '11 at 22:31
add comment

I agree with most of the other posters about some of these being better done with milters.

For point (1), is there any valid reason not to reject all mail from outside claiming to be from your domain? If not, this is best done by defining SPF records and using spf-milter to reject all incoming mail that violates a published SPF record.

For point (3), this should be done already, as it's standard in sendmail. It's usually necessary to turn on

FEATURE(`accept_unresolvable_domains')

in the m4 config file in order to get sendmail to accept email from invalid domains. Check your m4 file; if that line is there, remove it and regenerate your cf file.

Honestly, you could sit there trying to reinvent the wheel for spam reduction spoke-by-spoke, but lots of other people have done lots of other good work in this field already. For me, sendmail without the line above, plus milter-greylist and spf-milter, plus spamassassin-via-procmail on delivery, has reduced the spam in INBOXes by well over 99% (and the greylisting was the cheapest, biggest win of all).

share|improve this answer
add comment

You don't want to do this. There's no way the amount of effort you'd have to put in (and continue to put in, as spam trends change) to maintain a halfway-useful ruleset would be worth the result. Have a look at milter.org for a catalogue of excellent, community-maintained rulesets, and consider SpamAssassin for more heavy-duty spam filtering at the Sendmail level. Hope that helps!

share|improve this answer
    
Yes, I'm going to implement spamassassin too, but those simple rules can reduce amount of spam two or three times (I'know it from my experience, I have those rules implemented by simple, custom milter program, but I don't want to maintain its source code any longer) –  user71061 Mar 2 '11 at 11:41
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.