You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Ken Johnson <kj...@eclypse.org> on 2017/01/18 17:13:20 UTC
Rule to compare rDNS to regular expression
Hi,
I would like to write a rule to compare the rDNS lookup of the sender's IP
address to a regular expression. I have written super simple URI rules for
/etc/spamassassin/local.cf (Debian Linux system) like this:
uri LOCAL_AWSURI /.*amazonaws\.com/
score LOCAL_AWSURI 2.6
describe LOCAL_AWSURI Links to site at amazonaws.com
which work as expected. But my Google searches for examples or discussion
must be the wrong search terms, as the search results are about other
topics, not the one I want.
Can someone provide an example or point me toward documentation of how to
write such a rule?
Thanks,
Ken
RE: Rule to compare rDNS to regular expression
Posted by Ken Johnson <kj...@eclypse.org>.
On Wednesday, January 18, 2017, I wrote:
>I would like to write a rule to compare the rDNS lookup of the
>sender's IP address to a regular expression. I have written
>super simple URI rules for /etc/spamassassin/local.cf (Debian
>Linux system) like this:
>
>uri LOCAL_AWSURI /.*amazonaws\.com/
>score LOCAL_AWSURI 2.6
>describe LOCAL_AWSURI Links to site at amazonaws.com
>
>which work as expected. But my Google searches for examples
>or discussion must be the wrong search terms, as the search
>results are about other topics, not the one I want.
>
>Can someone provide an example or point me toward
>documentation of how to write such a rule?
>
>Thanks,
>
>Ken
Thank you for the helpful responses!
Re: Rule to compare rDNS to regular expression
Posted by Axb <ax...@gmail.com>.
On 01/18/2017 06:13 PM, Ken Johnson wrote:
> Hi,
>
> I would like to write a rule to compare the rDNS lookup of the sender's IP
> address to a regular expression. I have written super simple URI rules for
> /etc/spamassassin/local.cf (Debian Linux system) like this:
>
> uri LOCAL_AWSURI /.*amazonaws\.com/
> score LOCAL_AWSURI 2.6
> describe LOCAL_AWSURI Links to site at amazonaws.com
>
> which work as expected. But my Google searches for examples or discussion
> must be the wrong search terms, as the search results are about other
> topics, not the one I want.
>
> Can someone provide an example or point me toward documentation of how to
> write such a rule?
https://wiki.apache.org/spamassassin/UsingSpamAssassin
"How to write and test new rules"
Header rules
header BLAH Received =~ /\.blah\.tld\b/
rules using "ALL =~" may hog your SA
also, when possible avoid using .*
Your SA's setup rules should provide tons of samples of all kinds..
Re: Rule to compare rDNS to regular expression
Posted by Paul Stead <pa...@zeninternet.co.uk>.
And a third answer! I’ve mentioned TagMatch before - https://github.com/fmbla/spamassassin-tagmatch
From https://spamassassin.apache.org/full/3.4.x/doc/Mail_SpamAssassin_Conf.html#template_tags
ifplugin Mail::SpamAssassin::Plugin::Tagmatch
tagmatch __TAGMATCH_RDNS_AWS _LASTEXTERNALRDNS_ =~ /\.amazonaws\.com$/
meta LOCAL_AWSURI __TAGMATCH_RDNS_AWS
score LOCAL_AWSURI 2.6
describe LOCAL_AWSURI Last rDNS amazonaws.com
endif
I find .compute.amazonaws.com a good indicator
Paul
On 18/01/2017, 17:13, "Ken Johnson" <kj...@eclypse.org> wrote:
Hi,
I would like to write a rule to compare the rDNS lookup of the sender's IP
address to a regular expression. I have written super simple URI rules for
/etc/spamassassin/local.cf (Debian Linux system) like this:
uri LOCAL_AWSURI /.*amazonaws\.com/
score LOCAL_AWSURI 2.6
describe LOCAL_AWSURI Links to site at amazonaws.com
which work as expected. But my Google searches for examples or discussion
must be the wrong search terms, as the search results are about other
topics, not the one I want.
Can someone provide an example or point me toward documentation of how to
write such a rule?
Thanks,
Ken
--
Paul Stead
Systems Engineer
Zen Internet
Re: Rule to compare rDNS to regular expression
Posted by Paul Stead <pa...@zeninternet.co.uk>.
Why not a fourth?
Set up rbldnsd listing “.amazonaws.com” – plus whatever else you want, then use some built-in AskDNS stuff:
askdns LOCAL_RBL_EXTERNAL_RDNS _LASTEXTERNALRDNS_.lookup.example.com A 127.0.0.2
askdns interpolates tags before using them as a DNS lookup
http://search.cpan.org/dist/Mail-SpamAssassin/lib/Mail/SpamAssassin/Plugin/AskDNS.pm
Paul
On 18/01/2017, 17:13, "Ken Johnson" <kj...@eclypse.org> wrote:
Hi,
I would like to write a rule to compare the rDNS lookup of the sender's IP
address to a regular expression. I have written super simple URI rules for
/etc/spamassassin/local.cf (Debian Linux system) like this:
uri LOCAL_AWSURI /.*amazonaws\.com/
score LOCAL_AWSURI 2.6
describe LOCAL_AWSURI Links to site at amazonaws.com
which work as expected. But my Google searches for examples or discussion
must be the wrong search terms, as the search results are about other
topics, not the one I want.
Can someone provide an example or point me toward documentation of how to
write such a rule?
Thanks,
Ken
--
Paul Stead
Systems Engineer
Zen Internet
Re: Rule to compare rDNS to regular expression
Posted by RW <rw...@googlemail.com>.
On Wed, 18 Jan 2017 11:13:20 -0600
Ken Johnson wrote:
> Hi,
>
> I would like to write a rule to compare the rDNS lookup of the
> sender's IP address to a regular expression. I have written super
> simple URI rules for /etc/spamassassin/local.cf (Debian Linux system)
> like this:
>
> uri LOCAL_AWSURI /.*amazonaws\.com/
> score LOCAL_AWSURI 2.6
> describe LOCAL_AWSURI Links to site at amazonaws.com
>
> which work as expected. But my Google searches for examples or
> discussion must be the wrong search terms, as the search results are
> about other topics, not the one I want.
>
> Can someone provide an example or point me toward documentation of
> how to write such a rule?
It depends on what you are trying to, but all of the following look for
a hostname on example.com.
header LOCAL_TEST1 X-Spam-Relays-External =~ /^[^\]]+ rdns=\S+\.example\.com /i
header LOCAL_TEST2 X-Spam-Relays-Untrusted =~ /^[^\]]+ rdns=\S+\.example\.com /i
header LOCAL_TEST3 X-Spam-Relays-Untrusted =~ / rdns=\S+\.example\.com /i
LOCAL_TEST1 looks the last-external rDNS which is suitable for
positive scoring rules that can't safely be run deeply.
LOCAL_TEST2 looks at the first-trusted rDNS which is suitable for
negative scoring rules where you don't want to allow forged headers to
be used.
LOCAL_TEST3 is for positive-scoring tests that can safely run deeply
(on any relay outside your trusted network).
X-Spam-Relays-External and X-Spam-Relays-Untrusted are pseudo-headers
that are constructed from information parsed out of the received
headers. You don't have to add either to use them, but it's worth doing
so just to see what they are like.