Re: [exim] ACL spam filter deny but continue delivering

Top Pagina
Delete this message
Reply to this message
Auteur: Mike Cardwell
Datum:  
Aan: Exim Users List
Onderwerp: Re: [exim] ACL spam filter deny but continue delivering
Rene Rebe wrote:

> I use exim for quite some time in our office, but some users are unhappy with our spam filtering, because they think they loose important mails. Currently we just drop all spam-assassin classified mail in the ACL, like:
>
>   deny message = Our software thinks the message was spam
>         spam = nobody

>
> To make those users more happy I wanted to change the exim configuration to instead move the classified messages in an spam sub-folder so they can review if they think they missed something. However, after some hours of trial'n error I have not found a perfect solution. The best so far was to mark the message header and use the system filter like:
>
> if      $h_X-Spam-IsSpam contains "1" and not error_message
> then
>         save $home/Maildir/.0-Spam/
>         fail text "The message was classified as SPAM and might not be seen by a human user ..."
> endif

>
> However, this has multiple drawbacks: First the message is initially accepted, and thus we might continue receiving spam thru this channel (host) as it thinks the address is valid and continues sending, and second, the filter "fail" action will often generate a new message directly to the user as much spam is send with From: == To: so that the new fail error message get's to the user which did not send it, ...
>
> I'm wondering if there is something like "deny but continue" in the ACL config that would indicate an error in the "data-in receive phase" and thus let the upstream host generate the error message, if any, but continue delivering the message locally so that exim can save it into some "potentially spam" sub-directory.


Doing the following in the data acl will accept the message yet return a
rejection code to the sending MTA, just as if you had done a deny:

accept spam = nobody
        control = fakereject/Our software thinks the message was spam


--
Mike Cardwell - IT Consultant and LAMP developer
Cardwell IT Ltd. (UK Reg'd Company #06920226) http://cardwellit.com/
Technical Blog: https://secure.grepular.com/blog/