121 lines
4.8 KiB
Plaintext
121 lines
4.8 KiB
Plaintext
## ----------------------------------
|
|
# Trusted networks (internal usually)
|
|
&&TRUSTED_NETS {
|
|
client_address=192.168.0.0/16 ;
|
|
};
|
|
|
|
# Trusted hostnames
|
|
&&TRUSTED_HOSTS {
|
|
client_name~=.nooblet.org$ ;
|
|
};
|
|
|
|
# Trusted sasl usernames
|
|
&&TRUSTED_USERS {
|
|
sasl_username==stalks ;
|
|
};
|
|
|
|
# Free mailers we don't need to greylist
|
|
&&FREEMAIL {
|
|
client_name~=.gmx.net$ ;
|
|
client_name~=.web.de$ ;
|
|
client_name~=.(aol|yahoo|h(ush|ot)mail).co(.uk|m)$ ;
|
|
};
|
|
|
|
# Static IPs, no need to greylist
|
|
# contains freemailers
|
|
&&STATIC {
|
|
&&FREEMAIL ;
|
|
client_name~=[.-]static[[.-] ;
|
|
client_name~=^(mail|smtp|mout|mx)[-]*[0-9]*. ;
|
|
};
|
|
|
|
# Client reverse != smtp helo
|
|
&&BADHELO {
|
|
client_name==!!($$(helo_name)) ;
|
|
};
|
|
|
|
&&NORDNS {
|
|
client_name==unknown ;
|
|
};
|
|
|
|
&&DYNAMIC {
|
|
&&NORDNS ;
|
|
client_name~=(-.+){4} ;
|
|
client_name~=d{5} ;
|
|
client_name~=[_.-]([axt]{0,1}dsl|br(e|oa)dband|ppp|pppoe|dynamic|dynip|adsl|dial(up|in)|pool|dhcp|leased)[_.-] ;
|
|
};
|
|
&&DYNL {
|
|
rbl=zen.spamhaus.org/^127.0.0.1[0-1]$/3600 ;
|
|
rbl=dul.dnsbl.sorbs.net ;
|
|
};
|
|
|
|
&&RWL {
|
|
rbl=list.dnswl.org ;
|
|
rbl=hostkarma.junkemailfilter.com/^127.0.0.1$/3600 ;
|
|
rhsbl_client=hostkarma.junkemailfilter.com/^127.0.0.1$/3600 ;
|
|
};
|
|
|
|
&&RBL {
|
|
rbl=zen.spamhaus.org/^127.0.0.[2-8]$/3600 ;
|
|
rbl=hostkarma.junkemailfilter.com/^127.0.0.(2|4)$/3600 ;
|
|
rbl=bl.spamcop.net ;
|
|
rbl=problems.dnsbl.sorbs.net ;
|
|
rhsbl_client=hostkarma.junkemailfilter.com/^127.0.0.(2|4)$/3600 ;
|
|
rhsbl=rhsbl.ahbl.org ;
|
|
rhsbl=rhsbl.sorbs.net ;
|
|
};
|
|
|
|
##
|
|
## Ruleset
|
|
##
|
|
|
|
# stress-friendly behaviour (will not match on postfix version pre 2.5)
|
|
id=STRESS ; stress==yes ; action=dunno
|
|
|
|
# Whitelists (fixed)
|
|
id=WL_001 ; &&TRUSTED_NETS ; action=dunno
|
|
id=WL_002 ; &&TRUSTED_HOSTS ; action=dunno
|
|
id=WL_003 ; &&TRUSTED_USERS ; action=dunno
|
|
|
|
# Dynamic Counter
|
|
id=DYNL_001 ; &&DYNL ; rblcount=all ; action=set(HIT_dynls=$$rblcount, DYNL_text=$$dnsbltext)
|
|
|
|
# DNS Block Lists
|
|
id=RBL_001 ; &&RBL ;
|
|
rhsblcount=all ; rblcount=all ;
|
|
action=set(
|
|
HIT_rbls=$$rblcount,
|
|
HIT_rbls+=$$rhsblcount,
|
|
RBL_text=$$dnsbltext)
|
|
id=RBL_002 ; HIT_rbls>=2 ; action=REJECT You are listed on $$HIT_rbls RBLs. [$$RBL_text]
|
|
id=RBL_003 ; HIT_rbls>=1 ; HIT_dynls>=1 ; action=REJECT Host listed as dynamic and listed on RBL. [$$RBL_text]
|
|
id=RBL_004 ; HIT_rbls>=1 ; &&NORDNS ; action=REJECT No reverse DNS and listed on RBL. [$$RBL_text]
|
|
id=RBL_005 ; HIT_rbls>=1 ; &&DYNAMIC ; action=REJECT Host looks dynamic and listed on RBL. [$$RBL_text]
|
|
id=RBL_006 ; HIT_rbls>=1 ; &&BADHELO ; action=REJECT (helo $$helo_name) != ($$client_name) and listed on RBL. [$$RBL_text]
|
|
|
|
# Whitelists (rwl)
|
|
id=RWL_001 ; &&RWL ;
|
|
rhsblcount=all ; rblcount=all ;
|
|
action=set(
|
|
HIT_rwls=$$rblcount,
|
|
HIT_rwls+=$$rhsblcount,
|
|
RWL_text=$$dnsbltext)
|
|
id=RWL_002 ; HIT_rwls>=1 ; action=PREPEND X-POSTFWD: Listed on $$HIT_rwls whitelists. [$$RWL_text]
|
|
|
|
# Rate limits
|
|
id=RATE_001 ; HIT_rbls>=1 ; action=rate($$client_address/1/300/450 4.7.1 Throttled. Listed on RBL. Limited to 1 message every 5 minutes. [$$RBL_text])
|
|
id=RATE_002 ; HIT_dynls>=1 ; action=rate($$client_address/1/300/450 4.7.1 Throttled. Listed as dynamic. Limited to 1 message every 5 minutes.)
|
|
id=RATE_003 ; &&NORDNS ; action=rate($$client_address/1/300/450 4.7.1 Throttled. No reverse DNS. Limited to 1 message every 5 minutes.)
|
|
id=RATE_004 ; &&DYNAMIC ; action=rate($$client_address/1/300/450 4.7.1 Throttled. Host is probably dynamic. Limited to 1 message every 5 minutes.)
|
|
|
|
# Selective greylist
|
|
id=GREY_001 ; action=greylist ; HIT_rbls>=1
|
|
id=GREY_002 ; action=dunno ; &&STATIC
|
|
id=GREY_003 ; action=dunno ; $$client_name~=$$(sender_domain)$
|
|
id=GREY_004 ; action=dunno ; HIT_rwls>=1
|
|
id=GREY_005 ; action=greylist ; HIT_dynls>=1
|
|
id=GREY_006 ; action=greylist ; &&DYNAMIC
|
|
## greylist should be safe during out-of-office-hours
|
|
# id=GREY_007 ; action=greylist ; days=Sat-Sun
|
|
# id=GREY_008 ; action=greylist ; days=Mon-Fri ; time=!!06:00:00-20:00:0
|