local rule exclude all domains except "my list of approved"

[joe a <jo...@j4computers.com>]

As an increasing amount of SPAM from "boutique" domains began slipping 
through, I resorted assuring they are marked as SPAM by adding custom 
rules when sufficiently annoyed.

The local rules take this form (thanks to whoever provided the 
"template" for this):

header __LOCAL_FROM_BE  From =~ /.\.beauty/i
meta LOCAL_BE (__LOCAL_FROM_BE)
score  LOCAL_BE 2
describe LOCAL_BE from beauty domain

Initially I thought it might be fun to create a "match everything except 
what I list in this rule", so will search the Camel book, to learn or 
refresh.

But, likely someone has already done this, or, there is a simpler way 
already devised, hence the post.

I do not want to block these outright, say at the firewall or Postfix 
level, just simply flagged as SPAM, as some of these might deserve 
review at least for entertainment value.

Re: local rule exclude all domains except "my list of approved"

[Matus UHLAR - fantomas <uh...@fantomas.sk>]

>>>header __LOCAL_FROM_BE  From =~ /.\.beauty/i
>>>meta LOCAL_BE (__LOCAL_FROM_BE)
>>>score  LOCAL_BE 2
>>>describe LOCAL_BE from beauty domain

>On 1/5/2023 3:24 AM, Loren Wilton wrote:
>>You can simplify your rule code a little if you want:
>>header LOCAL_BE  From =~ /.\.beauty/i

perhaps:

header LOCAL_BE From:addr =~ /\.beauty$/i

would be even smarter, unless you wanty to catch ".beauty" in From: name 
-- 
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
I feel like I'm diagonally parked in a parallel universe.

Re: local rule exclude all domains except "my list of approved"

[joe a <jo...@j4computers.com>]

On 1/5/2023 3:24 AM, Loren Wilton wrote:
> You can simplify your rule code a little if you want:
> 
>> header __LOCAL_FROM_BE  From =~ /.\.beauty/i
>> meta LOCAL_BE (__LOCAL_FROM_BE)
>> score  LOCAL_BE 2
>> describe LOCAL_BE from beauty domain
> 
>     to
> 
> header LOCAL_BE  From =~ /.\.beauty/i
> score  LOCAL_BE 2
> describe LOCAL_BE from beauty domain
> 
> The meta isn't really doing anything there, since it only has a single 
> clause.
> Metas are good when you want to combine the results of several matches 
> with boolean logic.
> 
> You might also want to add a \b to the rule:
> 
> header LOCAL_BE  From =~ /.\.beauty\b/i
> 
> Without that the rule will match ".beauty", but also ".beautyrest".
> 
> Another thing you might want to consider is using "From:addr" rather 
> than just "From". As it is, it will match ".beauty" both in the address 
> and in the person's name description. So it would match:
> 
>     From: "janice.beautyfull" <ja...@cox.net>
> 
> Maybe you want that, in wihich a bare "From" is fine.
> 

Ah. Thanks.

Re: local rule exclude all domains except "my list of approved"

[Loren Wilton <lw...@earthlink.net>]

You can simplify your rule code a little if you want:

> header __LOCAL_FROM_BE  From =~ /.\.beauty/i
> meta LOCAL_BE (__LOCAL_FROM_BE)
> score  LOCAL_BE 2
> describe LOCAL_BE from beauty domain

    to

header LOCAL_BE  From =~ /.\.beauty/i
score  LOCAL_BE 2
describe LOCAL_BE from beauty domain

The meta isn't really doing anything there, since it only has a single 
clause.
Metas are good when you want to combine the results of several matches with 
boolean logic.

You might also want to add a \b to the rule:

header LOCAL_BE  From =~ /.\.beauty\b/i

Without that the rule will match ".beauty", but also ".beautyrest".

Another thing you might want to consider is using "From:addr" rather than 
just "From". As it is, it will match ".beauty" both in the address and in 
the person's name description. So it would match:

    From: "janice.beautyfull" <ja...@cox.net>

Maybe you want that, in wihich a bare "From" is fine.