Re: How to score mail to a defined address when not coming from a defined IP list

[Nigel Frankcom]

On Tue, 31 Oct 2006 11:19:40 +0100, Fabio [EMAIL PROTECTED]
wrote:

Hi,
I have a small site with some users and a sendmail mailing lists that contain 
all users. This mailing list is used almost exclusively by internal users, 
sending mail to all other users.
Unfortunately, I receive a lot of spam (about 60% of total spam) to this 
address, and this is bad because all users get the spams.

I'd like to add a custum rule that add a score (say 2.5) if a message is 
destinated to this address AND not come from a list of my IPs.

I am using SA 3.1 with MailScanner.

So the questions are:
1) What do you think of the effectiveness of this rule?
2) Do you know a better way for achieving the same result?
3) Is there a function that parse the Received field and return the 
originating IP? Which is it?

Thanks, 
  Fabio

Is there an option to allow only those on the list to post to it? I
don't know about SM but mine certainly has that option.

Nigel

Re: How to score mail to a defined address when not coming from a defined IP list

[Rubin Bennett]

On Tue, 2006-10-31 at 11:19 +0100, Fabio wrote:
 Hi,
 I have a small site with some users and a sendmail mailing lists that contain 
 all users. This mailing list is used almost exclusively by internal users, 
 sending mail to all other users.
 Unfortunately, I receive a lot of spam (about 60% of total spam) to this 
 address, and this is bad because all users get the spams.
 
 I'd like to add a custum rule that add a score (say 2.5) if a message is 
 destinated to this address AND not come from a list of my IPs.
 
 I am using SA 3.1 with MailScanner.
 
 So the questions are:
 1) What do you think of the effectiveness of this rule?
 2) Do you know a better way for achieving the same result?
 3) Is there a function that parse the Received field and return the 
 originating IP? Which is it?
 
 Thanks, 
   Fabio
 
header  MAILLIST_ORIG_IP Received !~ /your.ip.address.scheme/
describe MAILLIST_ORIG_IP Message from local LAN
header  MAILLIST_TO_ADDRESS =~ /[EMAIL PROTECTED]/i
describe MAILLIST_TO_ADDRESS Email to Internal Mailing List
metaPRIV_MAILLIST (MAILLIST_ORIG_IP  MAILLIST_TO_ADDRESS)
score   PRIV_MAILLIST 3.5

That *should* give you a rule that scores a 3.5 to mail sent to your
mailing list from an IP outside of your network.  You'll need to tinker
probably but that should get you started.

Rubin


-- 
Rubin Bennett
RB Technologies
http://thatitguy.com
[EMAIL PROTECTED]
(802)223-4448

They that can give up essential liberty to obtain a little
temporary security deserve neither liberty nor safety
  --Benjamin Franklin, Historical Review of Pennsylvania, 1759