Filter Backscatter via DNSBL

[Felix Buenemann <Fe...@gmx.de>]

Hi,

I'd like to filter out backscatter with the DNSBL from
ips.backscatterer.org. In order not to filter out legitimate mails, but
only NDA noise and stuff, I want to limit it to mails with blank
envelope from (MAIL FROM: <>) or envelope from postmaster (MAIL FROM:
<po...@example.com>).

I'm not confident in writing meta rules and also the EnvelopeFrom pseudo
header rule is poorly documented, so I wonder if the blank envelope from
rule will hit at all or should read /<>/ instead of //.

These are the proposed rules:

header __LOCAL_ENVELOPEFROM_BLANK EnvelopeFrom //
header __LOCAL_ENVELOPEFROM_POSTMASTER EnvelopeFrom /^postmaster/

header RCVD_IN_DNSBL_IPS_BACKSCATTERER_ORG
eval:check_rbl('ips-backscatterer-org','ips.backscatterer.org.')
describe RCVD_IN_DNSBL_IPS_BACKSCATTERER_ORG Received via a relay in
ips.backscatterer.org DNSBL
tflags RCVD_IN_DNSBL_IPS_BACKSCATTERER_ORG net

meta LOCAL_BACKSCATTERER_ORG  ((__LOCAL_ENVELOPEFROM_BLANK ||
__LOCAL_ENVELOPEFROM_POSTMASTER) && RCVD_IN_DNSBL_IPS_BACKSCATTER_ORG)
describe LOCAL_BACKSCATTERER_ORG Backscatter detected via
ips.backscatterer.org DNSBL
score LOCAL_BACKSCATTERER_ORG 10.0

Regards,
   Felix Buenemann