2

Running Sendmail Version 8.15.2 on Fedora 24 and lots of spam is coming in from (subdomain).(manydomains).us. I'd like to add a filter like what's available in the access file to block and .us TLD's that have a subdomain. For example: mail.us ---> OK anything.mail.us ---> REJECT

A regular expression might look like one of these:

[a-zA-Z_0-9.-]+@[a-zA-Z_0-9-]+?\.+[a-zA-Z_0-9.-]+?\.(us)$

or

|(.*\d.*\.us$)

Is there a place for this in the sendmail.mc file? I don't think regexps work in the access file. SpamAssassin and RBL's like Spamhaus should start catching these but here's sample from a false negative:

Return-Path: <Forbes.Emergency.Update@waiting.zzelite.us>
X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on
        ourdomain
X-Spam-Level: ***
X-Spam-Status: No, score=3.1 required=5.0 tests=BAYES_00,FROM_WORDY,
        HTML_FONT_LOW_CONTRAST,HTML_MESSAGE,RDNS_NONE,SPF_HELO_PASS,SPF_PASS,
        T_HTML_TAG_BALANCE_CENTER,T_REMOTE_IMAGE,URIBL_BLACK autolearn=no
        autolearn_force=no version=3.4.1
  • 1
    Domain is probably faked, they will probably switch to a new one as soon you block it. – Rui F Ribeiro Nov 29 '16 at 21:11
  • Right but I want to block all .us top level domains that have a subdomain. That was just 1 example there are many that got through. – RobbieTheK Nov 29 '16 at 21:13
  • see hansenonline.net/networking/sendmail-spam.html ; however DROP is far much more interesting than REJECT, but only to be used in some corner cases for obvious reasons – Rui F Ribeiro Nov 29 '16 at 21:30
  • That page references the access file which does not accept wildcards nor regular expressions and yes we already have enabled: FEATURE(`accept_unresolvable_domains')dnl – RobbieTheK Nov 29 '16 at 21:41
  • I am getting close. Using the K command in sendmail, as noted here, I have my regex as: [a-zA-Z_0-9.-]+@[a-zA-Z_0-9-]+?\.+[a-zA-Z_0-9.-]+?\.(us)$ But that doesn't seem to match. In the example this regex matches using the sendmail -bt test: ^([0-9]+<@(aol|msn)\.com|[0-9][^<]*<@juno\.com|.{10}[^<]+<@aol\.com)\.?> Is there a difference between my regex vs the awk/grep style? – RobbieTheK Dec 1 '16 at 15:29
0

I got it! Note it seems the indent before the regex and extra line space before LOCAL_CONFIG in the sendmail.mc file is needed. Hat tip to this XIITEC blog post for some clues as well as the sendmail cookbook.

LOCAL_CONFIG
# this will block subdomain.domain.us or subdomain.domain.info but not domain.us or domain.info
Kcheckaddress regex -a@MATCH
   [a-zA-Z_0-9.-]+<@[a-zA-Z_0-9-]+?\.+[a-zA-Z_0-9.-]+?\.(us|info)

HMessage-Id: $>CheckMessageId

SCheckMessageId
R< $+ @ $+ >            $@ OK
R$*             $#error $: "553 Header error"

LOCAL_RULESETS
SLocal_check_mail

R$*             $: $>Parse0 $>3 $1
R$+             $: $(checkaddress $1 $)
R@MATCH             $#error $: "553 Your Domain is Blocked for Unsolicited Mail"

Here's the proof it works:

sendmail -bt
ADDRESS TEST MODE (ruleset 3 NOT automatically invoked)
Enter <ruleset> <address>
> Local_check_mail 123@aol.com
Local_check_mail   input: 123 @ aol . com
canonify           input: 123 @ aol . com
Canonify2          input: 123 < @ aol . com >
Canonify2        returns: 123 < @ aol . com . >
canonify         returns: 123 < @ aol . com . >
Parse0             input: 123 < @ aol . com . >
Parse0           returns: 123 < @ aol . com . >
Local_check_mail returns: 123 < @ aol . com . >
> Local_check_mail 123@aol.com.us
Local_check_mail   input: 123 @ aol . com . us
canonify           input: 123 @ aol . com . us
Canonify2          input: 123 < @ aol . com . us >
Canonify2        returns: 123 < @ aol . com . us >
canonify         returns: 123 < @ aol . com . us >
Parse0             input: 123 < @ aol . com . us >
Parse0           returns: 123 < @ aol . com . us >
Local_check_mail returns: $# error $: "553 Your Domain is Blocked for Unsolicited Mail"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.