Gary, Thank you for the information. However, let me provide a little more info to clarify our situation:
We protect roughly 25 domains with postfix/amavis/spamassassin. All of these domains need to be able to talk to one another. Although we are using this system for incoming mail only, we, obviously, need to allow communication between the domains that we protect. What we are running into is a situation where spammers send an email destined for DOMAIN.COM and use DOMAIN.COM as the (spoofed) sender address. This hits our whitelist, etc. and is inevitably passed through the system... So, although we need to maintain communication between the various domains that we protect, what I'm trying to prevent is any email that has the same domain (DOMAIN.COM) in both the TO & FROM fields...as this is definitely an indication of spam, based on the way our system is setup... Since we only use this solution for incoming mail and there are no users who 'relay' from the outside, evaluating both the TO & FROM fields should serve our purpose... As I said, I've tried to accomplish this using meta rules in SA, but have not had any (good) luck... If I'm way off base, just say so! If you have any alternate great ideas, please share!! Thanx again for your assistance... Dustin. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Gary V Sent: Wednesday, March 15, 2006 12:33 PM To: amavis-user@lists.sourceforge.net Subject: Re: [AMaViS-user] Advanced Rule... Dustin wrote: > I need to create a rule that evaluates both the To: & From: addresses > (domains) in an e-mail. I want to mark/tag/block/whatever e-mails that > have the same originating & destination domains (i.e. the sender is > spoofing the recipient domain). Then your users cannot send mail to each other. What you are after is mail From: and To: your domain, but not from clients/severs on your network. > I have played around with some meta > rules in SpamAssassin, but have met with limited success... > 1) is this correct way to approach this issue? > 2) If so, how would you construct the rule to make it work? > 3) If this is not the way to accomplish this task, how would you suggest > that this task be accomplished? > As always, your input is greatly appreciated... > Thank you. > Dustin. This has been discussed on the Postfix mailing list a number of times, and you should know that once configured, it breaks forwarding. If you are using Postfix, search the archives for "breaks forwarding". http://marc.theaimsgroup.com/?l=postfix-users Here are a few examples: http://marc.theaimsgroup.com/?l=postfix-users&m=113226800214718&w=2 http://marc.theaimsgroup.com/?l=postfix-users&m=112679495620093&w=2 http://www.stahl.bau.tu-bs.de/~hildeb/postfix/postfix_incoming.shtml Gary V ------------------------------------------------------- This SF.Net email is sponsored by xPML, a groundbreaking scripting language that extends applications into web and mobile media. Attend the live webcast and join the prime developer group breaking into this new coding territory! http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642 _______________________________________________ AMaViS-user mailing list AMaViS-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/ ------------------------------------------------------- This SF.Net email is sponsored by xPML, a groundbreaking scripting language that extends applications into web and mobile media. Attend the live webcast and join the prime developer group breaking into this new coding territory! http://sel.as-us.falkag.net/sel?cmd=lnk&kid0944&bid$1720&dat1642 _______________________________________________ AMaViS-user mailing list AMaViS-user@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
