Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Incoming message have multiple adresses in the envelope-to and to headers. I want to discard all the original recipients and deliver that message to the special single address if some condition matches in ACL. How that can be done?

share|improve this question
Can you illustrate what you're trying to do with some examples? -- Right now this question sounds like you're looking for the thing. You know, the thing! With the stuff that does the whozits with that other kajigger! –  voretaq7 Mar 14 '12 at 3:15
So that's a picture: I have a list of regexes to catch sending hosts from dyn-ip networks. All such hosts have to send their mail via their provider's relay. During MAIL stage of smtp session I have $sender_host_name that searches against list mentioned above. If hostname matches, I want to replace all recipients by honeypot@my.tld –  Kondybas Mar 14 '12 at 11:14
You want spam filtering. There are infinitely better ways to do this, like DNS block lists (zen.spamhaus.org) –  voretaq7 Mar 14 '12 at 16:50
(note that you don't have to discard messages based on a blacklist hit. You can instruct your MTA to do other things, or call an external script/milter to do the lookup and act accordingly) –  voretaq7 Mar 14 '12 at 16:55
Also, DNSBLs has no significant effect as far as botnets are smart enough to use correct requisites stolen from infected hosts. Comparable effect can be obtained by simple filtering at CONN and RCPT stages of smtp session. With no DNSBL/greylists only 3-5% of spam reaches my spamd. Now I want to pipe spam to sa-learn instead rejecting it. Without redirect-router message have been piped to sa-learn per each recipient. Now - only once. Case closed. –  Kondybas Mar 14 '12 at 18:53
show 1 more comment

1 Answer

It sounds like what you want is to classify any email sent to your host directly from an IP in a dynamic range as spam, and feed those messages to SpamAssassin so it can learn the characteristics of those spam messages in case they come from "legitimate" servers.

If that is the case what you want to do can be accomplished without doing regex matches on the email's headers to isolate senders (computationally expensive!), and without rewriting emails (also computationally expensive, adding an extra step), by leveraging DNS blacklists.

  1. Check your mail against an appropriate DNS block list
    (The Spamhaus PBL will have a list of "dyn-ip networks", and it is almost certainly more accurate & less time-consuming than a list you maintain by hand. Alternatively you could use the Zen list and catch lots of other stuff too)

  2. If the mail is a hit on the blacklist:
    • Feed it to SpamAssassin (pipe sa-learn)
    • Discard the message (fail or finish it as you desire)

I'm not an Exim expert, but from examining the documentation this whole chain can be assembled using exim filter files and a dnsdb lookup (in place of the built-in blacklist support).
If you want to then add your regex matching as additional conditions you can certainly do that as well, but no recipient rewriting appears to be necessary.

share|improve this answer
If someone happens to assemble such a filter please post it as an answer - I don't have an exim box around to test with, but I'll happily upvote a working solution that's more than just my algorithmic outline –  voretaq7 Mar 14 '12 at 19:40
can I post my currenf config as answer to my own question? I'm not familiar enough with serverfault and don't know local rules in depth. –  Kondybas Mar 15 '12 at 23:59
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.