This question continues from this identical but focuses on another aspect of detail: the Postfix testing tool and the different options.
As the OP of the linked question, to prevent spam, and specifically, compromised password extortions, I have tried to block mail that contains my pwned old password as a means of chaffing.
Supposed the hacked password was... P@ssw0rd
, here is what I have done:
I have created a regex rule in /etc/postfix/header_checks
/^Subject: .*P@ssw0rd.*/i REJECT I know you are scamming me
Then re-checked main.cf
header_checks = regexp:/etc/postfix/header_checks
According to the answers to the linked question, I double checked the master.cf for options that override the header checks. Since I use dkimproxy
, which runs after smtp
but before delivery, I had the no_header_checks
option only on the dkim completion listener (port 10028 as recommended by manuals). I also tried to comment.
Now the test. If I pick an extortion email displaying my P@ssw0rd
and push it to postconf I get different results. Please note the regex is flagged case insensitive
# postmap -q "Subject: Videos of you - P@ssw0rd" regexp:/etc/postfix/header_checks
# postmap -fq "Subject: Videos of you - P@ssw0rd" regexp:/etc/postfix/header_checks
DISCARD I know you are scamming me
The above example also worked with the magic blue pill
So I am stuck with this. I have read the answer by Alexis Wilke and learned that Postfix by default uses case insensitive comparison. Wow, I don't care about the case, I specified /i
flag.
And regexpal successfully finds the subject line when I put the headers into it.
Question: what is not working here?