Hello Witse do you mean to use HOLD action on header_checks ? like this ?
/^Subject:.*hacked*/ HOLD And that whats suppose to do ? It is holded the email on the queue ? and I can check with mailq command ? and later detele from queue and email me a alert Sorry for ask and not try, because we have only enviroment on producction and dont make a misstake on the service. Regards El lun., 27 abr. 2020 a las 12:59, Wietse Venema (<wie...@porcupine.org>) escribió: > jmpatagonia: > > Hello I need help to using header_checks, I create a rule > > > > /^Subject:.*hacked*/ DISCARD > > An alternative is to use HOLD action, assuming you aren't using > software that hijacks the HOLD feature for other purposes, such as > mailscanner. Then you can review the email with "postcat -q" and > delete it with "postsuper -d". > > > that work propertly, but a want to know it is posible to email me o to > alert > > me when this rule occur or is aplicated. For some way. Oviusly I see > that on > > the mail.log > > A logfile scanner such as fail2ban could do that for you. Ideally > there is a rate limit so that you won't be email bombed. > > Wietse >
