Re: Discard all emails containing the text "#364811"?

2016-02-11 Thread D'Arcy J.M. Cain 
On Thu, 11 Feb 2016 09:50:36 -0500 (EST)
wie...@porcupine.org (Wietse Venema) wrote:
> - Rejecting mail on the basis of a short string is likely to result
>   in false matches.

For example, it would block this thread.

-- 
D'Arcy J.M. Cain
System Administrator, Vex.Net
http://www.Vex.Net/ IM:da...@vex.net
VoIP: sip:da...@vex.net

Re: Discard all emails containing the text "#364811"?

2016-02-11 Thread Mike Coddington 

> On Feb 11, 2016, at 9:17 AM, Sebastian Nielsen  wrote:
> 
> Is it anyway I can in postfix, use a simple rule to DISCARD all email 
> containing the text ” #364811”?
> (Its a HTML color being used in a lot (>95%) of spams currently arriving in 
> my server, and that color do not change).

You’d want to use a content filter that receives the mail, scans it for the 
offending text, and then re-queues the mail. It’s the same way SpamAssassin 
works.

http://www.postfix.org/FILTER_README.html

Re: Discard all emails containing the text "#364811"?

2016-02-11 Thread Wietse Venema 
Mike Coddington:
> 
> > On Feb 11, 2016, at 9:17 AM, Sebastian Nielsen  wrote:
> > 
> > Is it anyway I can in postfix, use a simple rule to DISCARD all email 
> > containing the text ? #364811??
> > (Its a HTML color being used in a lot (>95%) of spams currently arriving in 
> > my server, and that color do not change).
> 
> You?d want to use a content filter that receives the mail, scans it for the 
> offending text, and then re-queues the mail. It?s the same way SpamAssassin 
> works.
> 
> http://www.postfix.org/FILTER_README.html 
> 

Someone may suggest body_checks, but bear in mind that:

- Rejecting mail on the basis of a short string is likely to result
  in false matches.

- body_checks does not decode base64, quoted-prinable etc.

- body_checks examines only the first $body_checks_size_limit bytes.

Wietse

Discard all emails containing the text "#364811"?

2016-02-11 Thread Sebastian Nielsen 
Is it anyway I can in postfix, use a simple rule to DISCARD all email
containing the text " #364811"?

(Its a HTML color being used in a lot (>95%) of spams currently arriving in
my server, and that color do not change).



smime.p7s
Description: S/MIME Cryptographic Signature