Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I want to force users sending mail to my server to use BCC (we're getting a lot of internal spam created by mailings to 30+ mailing lists which then reply to all).

I thought spamassassin could be a good place to start since it is already used for spam filtering. However, I'm not sure how to do this (or if spamassassin is really the right place to do it). My idea was to just make a bccfilter.cf which checks the number of To+Cc recipients and mark the mail as spam if it is larger than a number (e.g. 10). What is the best way to do this?

The only thing I came up whit is something like this:

header  LOCAL_FORCE_BCC_TO      To =~ /(.*?,){9,}/
header  LOCAL_FORCE_BCC_CC      Cc =~ /(.*?,){9,}/
meta    LOCAL_FORCE_BCC         (LOCAL_FORCE_BCC_TO || LOCAL_FORCE_BCC_CC)
score   LOCAL_FORCE_BCC         15.0

It basically counts the number of comma's in the To and Cc header and if either one is larger than 9 (=10 recipients) is marks the message as spam. However I don't really like the approach and have the feeling it can be done better. Also I'd like to count the total number of recipients (To+Cc) instead of seperatly.

Does anyone know how to do that? Also I'd like to return a custom error message but that doesn't really matter much.

share|improve this question

migrated from stackoverflow.com Jul 3 '11 at 9:19

This question came from our site for professional and enthusiast programmers.

2  
Marking the mails as spam seems like the exact wrong approach. What would be far better would be a mail queue for mail messages with > 10 recipients. Hold the mail in a queue, reply to the user with an email that gives an URL to a web-based administrative interface, and clearly list each and every recipient. Make them click another silly "confirm" button there. No click, no mail. It'd also save the CEO from embarrassing emails to all staff. –  sarnold Jul 3 '11 at 9:15
1  
@sarnold the problem is not that the mails are accidentally To/CC'ed, they are To/CC'ed on purpose to generate more mail and thus advertising for the internal event –  dtech Jul 3 '11 at 9:16
1  
you mean they intentionally hit Reply To All when replying? I've seen hundreds of cases of people accidentally hitting it (the stupid default for too many email clients), but .. wow. –  sarnold Jul 3 '11 at 9:24
1  
@sarnold Yes well that's why we want to stop it. We're a fraternity+sorrority with >1000 members of which ~50 enjoy the massive spamming and the other ~600 subscribers members hate it –  dtech Jul 3 '11 at 9:26
1  
My condolences! Postfix's smtpd_recipient_limit might do the trick: "The maximal number of recipients that the Postfix SMTP server accepts per message delivery request." See postconf(5). –  sarnold Jul 3 '11 at 9:38

1 Answer 1

up vote 2 down vote accepted

I think this is a great time to look into exim ACL's. You can use them to do your cc: to bcc rewriting.

http://tldp.org/HOWTO/Spam-Filtering-for-MX/exim-smtpdelays.html

share|improve this answer
    
Interesting, I'll look into it. Of course a problem is that if users get no message they might be suprised and consider it a bug and come complaining to us. –  dtech Jul 6 '11 at 7:40

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.