Rule Help

[Dave <da...@grolen.com>]

I am trying to create a rule that scores TLD's in received headers if they are not certain TLD's. What I have so far:



header __GC_TLD_com Received !~ /\.com\b/i
header __GC_TLD_net Received !~ /\.net\b/i
header __GC_TLD_org Received !~ /\.org\b/i
header __GC_TLD_edu Received !~ /\.edu\b/i
header __GC_TLD_uk Received !~ /\.uk\b/i
describe GC_TLD Not common TLD
meta GC_TLD (( __GC_TLD_com + __GC_TLD_net + __GC_TLD_org + __GC_TLD_edu + __GC_TLD_uk) > 0)
score GC_TLD 2





The problem I am having is each rule tests all received headers so if the email passes through a .com and a .net TLD then the rule is triggered. So what I think I need to do is have 1 rule that checks each received header for all TLD's at once instead of each received header for each TLD. So I'm thinking I need an or operator if it exists, so something like this?:



header GC_TLD Received !~ /\.com\b/I || Received !~ /\.net\b/I || Received !~ /\.org\b/I || Received !~ /\.edu\b/I || Received !~ /\.uk\b/I

describe GC_TLD Not common TLD
score GC_TLD 2



Can someone help me out or point me in the right direction?




Thanks,
Dave
Grolen Communications
daves@grolen.com<ma...@grolen.com>
http://www.grolen.com/
Like Grolen on Facebook!
603-645-0101 Option 7, x304

Re: Rule Help

[Joe Quinn <jq...@pccc.com>]

On 9/25/2015 10:28 AM, Dianne Skoll wrote:
> On Fri, 25 Sep 2015 14:21:50 +0000
> Dave <da...@grolen.com> wrote:
>
>> I am trying to create a rule that scores TLD's in received headers if
>> they are not certain TLD's. What I have so far:
> Your logic is wrong.  And you can do it all with one regex:
>
> header GC_TLD_COM Received !~/\.(?:com|net|org|edu|uk)\b/i
>
> I won't comment on the advisability of such a rule; the policy is up to you.
> Also beware that this will trigger on IPs with no reverse DNS.
>
> Regards,
>
> Dianne.
I'll comment, since I like these sorts of rules.

There's a ridiculous amount of TLDs, and their use is starting to 
becoming more common to the point of almost routine, between t.co, 
goo.gl, etc. That makes a rule like yours hard to justify most of the 
time, but I can see industries where it's valid to give a very low score 
on the order of 0.5 tops. Typically you will want to work backwards and 
write rules for "these TLDs are particularly bad". You should think very 
long and hard before blacklisting a TLD entirely, as well. The only 
scenario I can imagine being valid would be if you were running a school 
and blacklisting the .xxx TLD.

This might be a nice light spam indicator, but like all broad rules it's 
easy to end up with a 10% FP rate. You need a full understanding of the 
mail traffic it operates on, which nobody else on-list has but you.

Re: Rule Help

[jdow <jd...@earthlink.net>]

On 2015-09-26 07:12, RW wrote:
> On Fri, 25 Sep 2015 10:28:42 -0400
> Dianne Skoll wrote:
>
>> On Fri, 25 Sep 2015 14:21:50 +0000
>> Dave <da...@grolen.com> wrote:
>>
>>> I am trying to create a rule that scores TLD's in received headers
>>> if they are not certain TLD's. What I have so far:
>>
>> Your logic is wrong.  And you can do it all with one regex:
>>
>> header GC_TLD_COM Received !~/\.(?:com|net|org|edu|uk)\b/i
>>
>> I won't comment on the advisability of such a rule; the policy is up
>> to you. Also beware that this will trigger on IPs with no reverse DNS.
>
> There's usually a helo hostname even if there's no rDNS. The real
> problem, as in the original rule, is that a single .com, .net etc
> anywhere in the received headers causes it to fail.
>
> Looking for any tlds that aren't on a list is fraught with problems -
> particularly if you try to do it with received headers.

You mean something like, "badnetizen.borg.combeduck.foobar.yukky"?

{O.O}

Re: Rule Help

[RW <rw...@googlemail.com>]

On Fri, 25 Sep 2015 10:28:42 -0400
Dianne Skoll wrote:

> On Fri, 25 Sep 2015 14:21:50 +0000
> Dave <da...@grolen.com> wrote:
> 
> > I am trying to create a rule that scores TLD's in received headers
> > if they are not certain TLD's. What I have so far:
> 
> Your logic is wrong.  And you can do it all with one regex:
> 
> header GC_TLD_COM Received !~/\.(?:com|net|org|edu|uk)\b/i
> 
> I won't comment on the advisability of such a rule; the policy is up
> to you. Also beware that this will trigger on IPs with no reverse DNS.

There's usually a helo hostname even if there's no rDNS. The real
problem, as in the original rule, is that a single .com, .net etc
anywhere in the received headers causes it to fail.

Looking for any tlds that aren't on a list is fraught with problems -
particularly if you try to do it with received headers.

Re: Rule Help

[Dianne Skoll <df...@roaringpenguin.com>]

On Fri, 25 Sep 2015 14:21:50 +0000
Dave <da...@grolen.com> wrote:

> I am trying to create a rule that scores TLD's in received headers if
> they are not certain TLD's. What I have so far:

Your logic is wrong.  And you can do it all with one regex:

header GC_TLD_COM Received !~/\.(?:com|net|org|edu|uk)\b/i

I won't comment on the advisability of such a rule; the policy is up to you.
Also beware that this will trigger on IPs with no reverse DNS.

Regards,

Dianne.