Re: How to score mail to a defined address when not coming from a defined IP list

[Rubin Bennett <rb...@thatitguy.com>]

On Tue, 2006-10-31 at 11:19 +0100, Fabio wrote:
> Hi,
> I have a small site with some users and a sendmail mailing lists that contain all users. This mailing list is used almost exclusively by internal users, sending mail to all other users.
> Unfortunately, I receive a lot of spam (about 60% of total spam) to this address, and this is bad because all users get the spams.
> 
> I'd like to add a custum rule that add a score (say 2.5) if a message is destinated to this address AND not come from a list of my IPs.
> 
> I am using SA 3.1 with MailScanner.
> 
> So the questions are:
> 1) What do you think of the effectiveness of this rule?
> 2) Do you know a better way for achieving the same result?
> 3) Is there a function that parse the Received field and return the originating IP? Which is it?
> 
> Thanks, 
>   Fabio
> 
header	MAILLIST_ORIG_IP Received !~ /your.ip.address.scheme/
describe MAILLIST_ORIG_IP Message from local LAN
header	MAILLIST_TO_ADDRESS =~ /\yourmailinglist\@yourdomain.com/i
describe MAILLIST_TO_ADDRESS Email to Internal Mailing List
meta	PRIV_MAILLIST (MAILLIST_ORIG_IP && MAILLIST_TO_ADDRESS)
score	PRIV_MAILLIST 3.5

That *should* give you a rule that scores a 3.5 to mail sent to your
mailing list from an IP outside of your network.  You'll need to tinker
probably but that should get you started.

Rubin


-- 
Rubin Bennett
RB Technologies
http://thatitguy.com
rbennett@thatitguy.com
(802)223-4448

"They that can give up essential liberty to obtain a little
temporary security deserve neither liberty nor safety"
  --Benjamin Franklin, Historical Review of Pennsylvania, 1759