Re: Blacklisting the originating MTA

On Mon, 27 Apr 2009, Doug Hardie wrote:

> To: [email protected]
> From: Doug Hardie <[email protected]>
> Subject: Re: Blacklisting the originating MTA
> 
> In article <[email protected]>,
> Keith Roberts <[email protected]> wrote:
>
>> Try viewing the full headers of the specific emails you want
>> to block.
>>
>> You should be able to see the path the email has taken to
>> reach you, from the original sender.
>>
>> You may then be able to block the emails using the
>> domain name(s) in the headers.
>
> The TMDA documentation for filters seems to be saying that from-file
> only checks the from email address and does not check the real domains
> of the MTAs involved.
>

That's correct, but you can also block on the content of the 
email headers, using a rule like this in your tmda incoming 
file:

# unacceptable regex matches for other mail header fields
## headers-file ~/.tmda/filters/headers_reject [email protected]

headers-file ~/.tmda/filters/headers_reject drop

and then create a headers_reject file with RegEx content for 
the matches you want to reject, like:


#Regular Expression Files

#A regular expression textfile is simply a text file with a 
#regular expression on each line, as defined in Python's re 
#module.

#The file is read sequentially and each regular expression 
#is used to attempt a match. As soon as there is a match, 
#the search stops.

#Because regular expressions may include spaces, you must 
#surround the regular expressions with quotation marks. You 
#may use either single quotes (') or double quotes (") as 
#long as you use the the same one at both the beginning and 
#the end. If you need to match a quote in your regular 
#expression, simply use the other style of quotes to 
#surround the expression or escape the embedded quote with a 
#backslash (\).


# reject any email with the following matching headers
"http:\/\/www\.some-domain\.com"
"Microsoft XP \<php\-install\@lists.php.net\>"

Eg. in the headers from your email I see:

Received: from pool-71-109-162-173.lsanca.dsl-w.verizon.net
  ([71.109.162.173])

So adding the following rule:

"lsanca\.dsl\-w\.verizon\.net"

to my headers_reject file should match and block anything 
from that domain.

Kind Regards,

Keith Roberts

-----------------------------------------------------------------
Websites:
http://www.php-debuggers.net
http://www.karsites.net
http://www.raised-from-the-dead.org.uk

All email addresses are challenge-response protected with
TMDA [http://tmda.net]
-----------------------------------------------------------------

------------------------------------------------------------------------------
Register Now & Save for Velocity, the Web Performance & Operations 
Conference from O'Reilly Media. Velocity features a full day of 
expert-led, hands-on workshops and two days of sessions from industry 
leaders in dedicated Performance & Operations tracks. Use code vel09scf 
and Save an extra 15% before 5/3. http://p.sf.net/sfu/velocityconf
_______________________________________________
tmda-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tmda-users