Hello Mark Mark Martinec schrieb: > Thomas, > >>> Content is scanned regardless of @local_domains_maps, >>> it's just the adding of X-Spam-* header fields ... >> Sure. I also see this by a X-Virus-Scanned entry even for non $mydomain >> entries: X-Virus-Scanned: by amavisd-new at virusscan20.ourdomain.com > > There is always a choice of tweaking code a bit. > >> Thanks for this excellent explanation. The problem I face are all this >> unknown domains from our users. As a larger ISP we usually assign IP >> ranges to smaller ISPs or other customers. Some are PA ranges or from >> our several /16 ranges. This means i have no clue what kind of domain >> names they will host/use. >> >> But we provide for all this ip ranges a backup MX entry, based on this >> ip ranges in postfix. Some of this users want to use our mail >> environment for anti-spam protections. So they add our mailservers as >> backup mx, deny traffic to port 25 on there own primary mx except for >> our mail servers. >> >> The idea behind is, that every email goes trough our backup mx, will be >> scaned and tagged and delivered to the primary mx which has no anti spam >> solution. >> >> So there is no way out of the box to let amavisd-new add X-* tags to the >> header based on backup MX IP ranges entries and not domain names? > > Actually, there may be a better way. You probably already have > separate MTA for inbound mail (MX) and a different IP address for > mail submission (port 587 and 25, SASL/TLS). Such separation is > beneficial for DKIM signing decisions too.
Not exactly but i can implemented very easy. Because we already use different domains for MX, this can be changed to point to an ip alias on the mail systems. > > So probably from the mail route you already know if a message is > on its way out or in. This double path can lead through amavisd in a > form of two separate TCP port numbers, each loading its policy bank. > The policy bank on a port where only incoming mail will flow can > safely declare @local_domains_maps=(1); i.e. all recipient to be > local. Is this done by a policy daemon in postfix? Or how can postifx decide which of both content filter (TCP port) has to be used for amavisd? Maybe a stupid question but what are the risk to use a '.' in @local_domains_maps for everthing. Regards, Thomas ------------------------------------------------------------------------- This SF.Net email is sponsored by the Moblin Your Move Developer's challenge Build the coolest Linux based applications with Moblin SDK & win great prizes Grand prize is a trip for two to an Open Source event anywhere in the world http://moblin-contest.org/redirect.php?banner_id=100&url=/ _______________________________________________ AMaViS-user mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/amavis-user AMaViS-FAQ:http://www.amavis.org/amavis-faq.php3 AMaViS-HowTos:http://www.amavis.org/howto/
