RE: [AMaViS-user] Advanced Rule...

Gary,

Thank you for the information. However, let me provide a little more
info to clarify our situation:

We protect roughly 25 domains with postfix/amavis/spamassassin. All of
these domains need to be able to talk to one another. Although we are
using this system for incoming mail only, we, obviously, need to allow
communication between the domains that we protect. What we are running
into is a situation where spammers send an email destined for DOMAIN.COM
and use DOMAIN.COM as the (spoofed) sender address. This hits our
whitelist, etc. and is inevitably passed through the system...

So, although we need to maintain communication between the various
domains that we protect, what I'm trying to prevent is any email that
has the same domain (DOMAIN.COM) in both the TO & FROM fields...as this
is definitely an indication of spam, based on the way our system is
setup...

Since we only use this solution for incoming mail and there are no users
who 'relay' from the outside, evaluating both the TO & FROM fields
should serve our purpose...

As I said, I've tried to accomplish this using meta rules in SA, but
have not had any (good) luck...

If I'm way off base, just say so!

If you have any alternate great ideas, please share!!

Thanx again for your assistance...

Dustin.

-----Original Message-----
From: amavis-user-admin@lists.sourceforge.net
[mailto:amavis-user-admin@lists.sourceforge.net] On Behalf Of Gary V
Sent: Wednesday, March 15, 2006 12:33 PM
To: amavis-user@lists.sourceforge.net
Subject: Re: [AMaViS-user] Advanced Rule...

Dustin wrote:

> I need to create a rule that evaluates both the To: & From: addresses
> (domains) in an e-mail. I want to mark/tag/block/whatever e-mails
that
> have the same originating & destination domains (i.e. the sender is
> spoofing the recipient domain).

Then your users cannot send mail to each other. What you are after is
mail From: and To: your domain, but not from clients/severs on your
network.

> I have played around with some meta
> rules in SpamAssassin, but have met with limited success...

> 1) is this correct way to approach this issue?
> 2) If so, how would you construct the rule to make it work?
> 3) If this is not the way to accomplish this task, how would you
suggest
> that this task be accomplished?

> As always, your input is greatly appreciated...

> Thank you.

> Dustin.

This has been discussed on the Postfix mailing list a number of times,
and you should know that once configured, it breaks forwarding. If you
are using Postfix, search the archives for "breaks forwarding".
http://marc.theaimsgroup.com/?l=3Dpostfix-users

Here are a few examples:
http://marc.theaimsgroup.com/?l=3Dpo...0214718&w=3D2=

http://marc.theaimsgroup.com/?l=3Dpo...5620093&w=3D2=

http://www.stahl.bau.tu-bs.de/~hilde...incoming.shtml


Gary V



-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting
language
that extends applications into web and mobile media. Attend the live
webcast
and join the prime developer group breaking into this new coding
territory!
http://sel.as-us.falkag.net/sel?cmd=...241720&dat=3D=
121642
_______________________________________________
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/...fo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/




-------------------------------------------------------
This SF.Net email is sponsored by xPML, a groundbreaking scripting language
that extends applications into web and mobile media. Attend the live webcast
and join the prime developer group breaking into this new coding territory!
http://sel.as-us.falkag.net/sel?cmd=...720&dat=121642
_______________________________________________
AMaViS-user mailing list
AMaViS-user@lists.sourceforge.net
https://lists.sourceforge.net/lists/...fo/amavis-user
AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3
AMaViS-HowTos:http://www.amavis.org/howto/