Re: Block No Reverse DNS

On Thu, Jan 20, 2005 at 12:42:43AM -0700, Kevin Reed wrote:
> Matt said:
> > How do you setup Exim to refuse email from MTA's that do not have a valid
> > reverse DNS?
> > ...
> 
> We used to do that.  Blocked a lot of spam that way... but when I moved
> that trait into a large commercial environment, it lasted less than a
> week.  Way too many vendors, and other business contacts have questionable
> mail servers with poorly configured DNS to whitelist....  I gave up...
>

I use no reverse dns as one of a number of scored items.

1) no reverse dns
2) "helo" string was an ip address
3) bunch o' different RBL lookups

Each of these in itself is not enough to block a mail as even the best
RBLs will have false positives from time to time.  I pipe this result into
a per user or per domain lookup so they can choose how many points it
takes to consider the email not wanted.

FWIW my own mail is configured for 2 hits and it's denied.  In scanning
the logs I have yet to see what looked like a falsely denied email (out of
5,000 odd denials).


> # MARK HOSTS WITHOUT VALID RDNS
> warn    log_message = SETTING X-NO-rDNS
>         message = X-NO-rDNS: No rDNS Found for $sender_host_address
>         hosts = ! +exempt_lookup_hosts
>         !verify = reverse_host_lookup
>

Here's mine:

  warn domains = +local_domains
       set acl_m0 = 

  warn domains = +local_domains
       condition = ${if isip{$sender_helo_name} {yes}{no}}
       set acl_m0 = +${acl_m0} helo_is_ipaddr

  warn domains = +local_domains
       !verify = reverse_host_lookup
       set acl_m0 = +${acl_m0} no_reverse_dns

  warn domains = +local_domains
       dnslists = bl.spamcop.net
       set acl_m0 = +${acl_m0} $dnslist_domain/$dnslist_value

  (other RBL here)


  # Insert a message header with the results of our tests -- this lets you
  # have exim accept the mail but have your local MUA filter on the
  # results
  warn domains = +local_domains
       condition = ${if eq {$acl_m0}{} {0}{1}}
       message = X-RBL-Tests: ${acl_m0} for $sender_host_address


  # Here's the kludge.  I already plumped for a "++ item item" format for
  # the header, and now find it's tricky to do a match{} condition against
  # that special character.  Exim doesn't (to my knowledge) have a strstr
  # function, so I sg{} the + to # to let match{} work easier.
  #
  deny message = Recipient refuses mail from blacklisted (RBL) senders.
       domains = +local_domains
       condition = ${if match{${sg{$acl_m0}{\\+}{#}}} {${lookup{$local_part@$domain}lsearch*@{CONFDIR/acls/rbl-rcpt}{$value}{- NO MATCH -}}} {yes}{no}}



That file rbl-rcpt just looks like this:

[email protected]:  ##
*@domain.two:    ###
(etc)





> Spam assassin has rules to deal with your other issue... DLS pools etc..
> though we do have to whitelist some vendors because they fit that too.
>

Much as I like spam assassin (I use it with some success on other hosts) I
keep it out of the mix on the machine the above config fragment comes
from.  One more thing to break; one more thing to suck ram out of the box;
and when I'm getting perhaps 90% or 95% success with the simple rules it
seems like a lot of extra work for only a few extra percent of spam
blocks.

Additionally, the joy of the configuration above is that it takes place
BEFORE the data phase, and thus can accept/defer/deny/etc per recipient.
Once you get to spam assassin you're usually stuck with accepting or
denying everything regardless of the recipients' individual wishes - or
you have the less than perfect method of defering mail so that it only
comes in with "same config" batches.


Dave

-- 

-    Dave Baker      :      [email protected]      :      http://dsb3.com/    -
GnuPG:  1024D/D7BCA55D / 09CD D148 57DE 711E 6708  B772 0DD4 51D5 D7BC A55D