This question continues from this identical but focuses on another aspect of detail: the Postfix testing tool and the different options.
As the OP of the linked question, to prevent spam, and specifically, compromised password extortions, I have tried to block mail that contains my pwned old password as a means of chaffing.
Supposed the hacked password was...
P@ssw0rd, here is what I have done:
I have created a regex rule in
/^Subject: .*P@ssw0rd.*/i REJECT I know you are scamming me
Then re-checked main.cf
header_checks = regexp:/etc/postfix/header_checks
According to the answers to the linked question, I double checked the master.cf for options that override the header checks. Since I use
dkimproxy, which runs after
smtp but before delivery, I had the
no_header_checks option only on the dkim completion listener (port 10028 as recommended by manuals). I also tried to comment.
Now the test. If I pick an extortion email displaying my
P@ssw0rd and push it to postconf I get different results. Please note the regex is flagged case insensitive
# postmap -q "Subject: Videos of you - P@ssw0rd" regexp:/etc/postfix/header_checks # postmap -fq "Subject: Videos of you - P@ssw0rd" regexp:/etc/postfix/header_checks DISCARD I know you are scamming me
The above example also worked with the magic blue pill
And regexpal successfully finds the subject line when I put the headers into it.
Question: what is not working here?