Update to this.. Actually using
Received:*from unknown (*
Is extremely dangerous. Almost every email I get would match that,
including this one from the qmailtoaster list, which has this header.
Received: from unknown (HELO mail.whitehorsetc.com...
There may be a way to match headers that would work, possibly something
that would include portions of the internal private address with the
question marks. Anything starting with 10. or anything starting with
192.168. or with 172.16 through 172.31
But I need to look at a more headers to see if that would work. In
general I think it might if crafted properly.
Gary
On 6/18/2026 7:54 AM, Gary Bowling wrote:
Thanks, in looking at this, I see I can also set up a file for header
blacklisting by putting in:
header-blacklist-file=
In the conf file, then put the match in the file. I hadn't yet gotten
into header blocking but that might be a good thing to look at.
On 6/17/2026 11:31 PM, Miguel Angel Amable Ventura wrote:
Hello,
Maybe you can set in /etc/spamdyke/spamdyke.conf something like this:
header-blacklist-entry=Received:*from unknown (*
or maybe you can set /etc/spamdyke/blacklist_header with the
following content:
From: *unknown*
Return-Path: *darks10.Leakoihu.com*
But I haven't tried this last one.
Best regards.
El 16/06/2026 a las 06:58 a. m., Gary Bowling escribió:
Sometimes I get messages with this type of header? I'm surprised it
doesn't already get blocked by what I have in place, but somehow
they get through.
Received: from unknown (HELO ?10.88.0.4?) (34.53.228.165)
Is there something I can put in blacklist_senders to catch these? Or
some other way to block them?
Looks like they come from a private address behind a firewall with a
nat to a public address, typically from an ip based rdns entry
indicating it's some server probably at someone's house. I can block
those by enabling reject-ip-in-cc-rdns, but there seems like there
should be a way to block these based on the header. I haven't
implemented ip rdns blocking yet, I'm not sure why as pretty much
any legit email server should have a proper rdns of some sort. Or at
least I think they should.
Thanks
--
____________________
Gary Bowling
The Moderns album NEXT on your favorite streaming platform
<https://distrokid.com/hyperfollow/themoderns/next>
____________________
