1

Incoming message have multiple adresses in the envelope-to and to headers. I want to discard all the original recipients and deliver that message to the special single address if some condition matches in ACL. How that can be done?

6
  • 1
    Can you illustrate what you're trying to do with some examples? -- Right now this question sounds like you're looking for the thing. You know, the thing! With the stuff that does the whozits with that other kajigger!
    – voretaq7
    Mar 14, 2012 at 3:15
  • So that's a picture: I have a list of regexes to catch sending hosts from dyn-ip networks. All such hosts have to send their mail via their provider's relay. During MAIL stage of smtp session I have $sender_host_name that searches against list mentioned above. If hostname matches, I want to replace all recipients by [email protected]
    – Kondybas
    Mar 14, 2012 at 11:14
  • 1
    You want spam filtering. There are infinitely better ways to do this, like DNS block lists (zen.spamhaus.org)
    – voretaq7
    Mar 14, 2012 at 16:50
  • (note that you don't have to discard messages based on a blacklist hit. You can instruct your MTA to do other things, or call an external script/milter to do the lookup and act accordingly)
    – voretaq7
    Mar 14, 2012 at 16:55
  • 1
    Also, DNSBLs has no significant effect as far as botnets are smart enough to use correct requisites stolen from infected hosts. Comparable effect can be obtained by simple filtering at CONN and RCPT stages of smtp session. With no DNSBL/greylists only 3-5% of spam reaches my spamd. Now I want to pipe spam to sa-learn instead rejecting it. Without redirect-router message have been piped to sa-learn per each recipient. Now - only once. Case closed.
    – Kondybas
    Mar 14, 2012 at 18:53

1 Answer 1

1

It sounds like what you want is to classify any email sent to your host directly from an IP in a dynamic range as spam, and feed those messages to SpamAssassin so it can learn the characteristics of those spam messages in case they come from "legitimate" servers.

If that is the case what you want to do can be accomplished without doing regex matches on the email's headers to isolate senders (computationally expensive!), and without rewriting emails (also computationally expensive, adding an extra step), by leveraging DNS blacklists.

  1. Check your mail against an appropriate DNS block list
    (The Spamhaus PBL will have a list of "dyn-ip networks", and it is almost certainly more accurate & less time-consuming than a list you maintain by hand. Alternatively you could use the Zen list and catch lots of other stuff too)

  2. If the mail is a hit on the blacklist:
    • Feed it to SpamAssassin (pipe sa-learn)
    • Discard the message (fail or finish it as you desire)

I'm not an Exim expert, but from examining the documentation this whole chain can be assembled using exim filter files and a dnsdb lookup (in place of the built-in blacklist support).
If you want to then add your regex matching as additional conditions you can certainly do that as well, but no recipient rewriting appears to be necessary.

2
  • If someone happens to assemble such a filter please post it as an answer - I don't have an exim box around to test with, but I'll happily upvote a working solution that's more than just my algorithmic outline
    – voretaq7
    Mar 14, 2012 at 19:40
  • can I post my currenf config as answer to my own question? I'm not familiar enough with serverfault and don't know local rules in depth.
    – Kondybas
    Mar 15, 2012 at 23:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .