Correct PCRE in Exim Custom Filter File

Question

My Server:
- CentOS 7.6
- Exim 4.91-5

What I am looking to achieve
Using Exim I want to silently discard incoming emails from a user set list of wildcard matches. SpamAssassin and other tools are not suitable in this instance.

For example:

I want to block any emails coming from a domain ending in .icu:

• [email protected] BLOCKED
• [email protected] ALLOWED
• [email protected] ALLOWED
• [email protected] BLOCKED

What have I read so far?
To do this I have read this answer as well as the Exim documention however my first attempt failed and caused all emails to the server to be rejected.

My edit methodology
My system has an Exim list of additional custom filter rules in a folder; /usr/local/cpanel/etc/exim/sysfilter/options/

My file in that folder stands as:

#block email domains
if
  ( $h_from: matches ".*@.*\.opskee\.gq\$"
  or $h_from: matches ".*@.*\.icu\$" )
#then noerror seen finish
then 
  deliver "SpamTest <[email protected]>"
  seen finish
endif

Intention of the above PCRE:
To block any email whose from domain ends in <anything>@<anything>.opskee.gq or <anything>@<anything>.icu.

Testing
I tried testing the system using the reference in the other question but this just hung the SSH.

/usr/sbin/exim -bF <scriptfile> -f <sender>

Questions:

• Is my above PCRE correct (or at least, avoids obvious exim-specific erorrs)?
• Can a full complete example be provided/linked for the <sender> command in the above prompt?
• Some documentation (3rd party) referencing brackets around the if statement (I currently have this) and others do not; which is better?

Answer 1

The proper way is to use exim's ACL instead of filtering.
Find the part of config starting with the line like that:

acl_rcpt:

Your config can be different but acl, rcpt and semicolon should be present. Then there should be a number of blocks, starting with accept, deny, require and other verbs.
You have to add the new block:

deny condition = ${lookup{$sender_address}nwildlsearch{/path/black.list}{yes}} 
       message = Not that time, sorry.

File /path/black.list should contain banned addresses and/or regular expressions, one per line:

## You can block the certain sender
^some_spammer@domain\.icu
## Or everybody from some domain
^.*@domain\.icu
## Or even all top-level domain at once
^.*@.*\.icu

Here . is an PCRE token that means any symbol, .* means any number of any symbols while \. means the dot. Saying strictly the pattern ^.*@domain\.icu means:

Sender address starting with any number (0..n) of any symbols,
then symbol '@', 
then 'domain' substring,
and ending with '.icu' symbols

String [email protected] will match that RE.

Keep in mind that ACL rules are applied in the order they are defined in the configuration file. Those ACL you want to implement should be placed at the top of the ACL definitions for the RCPT stage.

Restart exim after reconfiguration.