[Exim] Rejecting spam based on a weighted sum of RBL hits.

Top Page
Delete this message
Reply to this message
Author: Łukasz Grochal
Date:  
To: exim-users
Subject: [Exim] Rejecting spam based on a weighted sum of RBL hits.
The method mentioned in subject has recently been proposed in a
Polish anti-spam usenet group as an alternative to just rejecting spam
if sender's IP is listed in some RBL. As it can be easily implemented
in Exim, I'm attaching a proof of concept implementation (based on
RBLs and their weights used by SpamAssassin). Hope someone will find
this useful. And I hope I haven't just reinvented the wheel ;>

acl_smtp_mail = check_mail
acl_smtp_rcpt = check_recipient

[...]

check_mail:
        # RCVD_IN_BL_SPAMCOP_NET
        warn    dnslists        = bl.spamcop.net
                set             acl_m0 = ${eval:$acl_m0+15}


        # RCVD_IN_BSP_OTHER
        warn    dnslists        = sa-other.bondedsender.org
                set             acl_m0 = ${eval:$acl_m0-1}


        # RCVD_IN_BSP_TRUSTED
        warn    dnslists        = sa-trusted.bondedsender.org
                set             acl_m0 = ${eval:$acl_m0-43}


        # RCVD_IN_DSBL
        warn    dnslists        = list.dsbl.org
                set             acl_m0 = ${eval:$acl_m0+7}


[... and so on - see spamassassin's 20_dnsbl_tests.cf and 50_scores.cf ]

        accept



check_recipient:
[...]

        accept  local_parts     = postmaster
                domains         = +local_domains


        deny    message         = Sender's IP listed in too many RBLs.
                condition       = ${if >{$acl_m0}{70}{yes}{no}}


Regards,

--
Łukasz Grochal            | Give an infinite number of monkeys typewriters
lukie [at] berdyczow.org  | and they'll produce  the works of Shakespeare.
PGP key, SSL cert etc. at | Unfortunately, I feel like I'm reading all the
http://www.berdyczow.org/ | books where they didn't.  /internetisshit.org/