ANTI-SPAM

The primary anti-spam features available in sendmail are:

• Relaying is denied by default.
• Better checking on sender information.
• Access database.
• Header checks.

If you really want to revert to the old behaviour, you will need to use

	sendmail.org
	128.32
	1:2:3:4:5:6:7
	host.mydomain.com

You can also allow relaying based on the MX records of the host portion of an incoming recipient address by using

Along the same lines,

A slightly better solution is

This option only works together with the tag From: for the LHS of the access map entries (see below: Finer control...). If source routing is used in the recipient address (i.e. RCPT TO: <user%site.com@othersite.com>), sendmail will check user@site.com for relaying if othersite.com is an allowed relay host in either class {R}, class {m} if FEATURE(`relay_entire_domain') is used, or the access database if FEATURE(`access_db') is used. To prevent the address from being stripped down, use:

NOTICE: It is possible to relay mail through a system which the anti-relay rules do not prevent: the case of a system that does use

As of 8.9, sendmail will refuse mail if the MAIL FROM: parameter has an unresolvable domain (i.e., one that DNS, your local name service, or special case rules in ruleset 3 cannot locate). If you want to continue to accept such domains, e.g., because you are inside a firewall that has only a limited view of the Internet host name space (note that you will not be able to return mail to them unless you have some "smart host" forwarder), use

An ``access'' database can be created to accept or reject mail from selected domains. For example, you may choose to reject all mail originating from known spammers. To enable such a database, use

	spammer@aol.com		REJECT
	cyberspammer.com	REJECT
	192.168.212		REJECT

	OK		Accept mail even if other rules in the
			running ruleset would reject it, for example,
			if the domain name is unresolvable.
	RELAY		Accept mail addressed to the indicated domain or
			received from the indicated domain for relaying
			through your SMTP server.  RELAY also serves as
			an implicit OK for the other checks.
	REJECT		Reject the sender or recipient with a general
			purpose message.
	DISCARD		Discard the message completely using the
			$#discard mailer.  If it is used in check_compat,
			it affects only the designated recipient, not
			the whole message as it does in all other cases.
			This should only be used if really necessary.
	### any text	where ### is an RFC 821 compliant error code and
			"any text" is a message to return for the command.
			The string should be quoted to avoid surprises,
			e.g., sendmail may remove spaces otherwise.
	ERROR:### any text
			as above, but useful to mark error messages as such.
	ERROR:D.S.N:### any text
			where D.S.N is an RFC 1893 compliant error code
			and the rest as above.

	cyberspammer.com	ERROR:"550 We don't accept mail from spammers"
	okay.cyberspammer.com	OK
	sendmail.org		RELAY
	128.32			RELAY
	1:2:3:4:5:6:7		RELAY
	[127.0.0.3]		OK
	[1:2:3:4:5:6:7:8]	OK

Warning: if you change the RFC 821 compliant error code from the default value of 550, then you should probably also change the RFC 1893 compliant error code to match it. For example, if you use

	user@example.com	450 mailbox full

Note, UUCP users may need to add hostname.UUCP to the access database or class {R}. If you also use:

You can also use the access database to block sender addresses based on the username portion of the address. For example:

	badlocaluser@		ERROR:550 Mailbox disabled for this username
	host.mydomain.com	ERROR:550 That host does not accept mail
	user@otherhost.mydomain.com	ERROR:550 Mailbox disabled for this recipient

	spammer@aol.com		REJECT
	cyberspammer.com	REJECT

There is also a ``Realtime Blackhole List'' run by the MAPS project at http://maps.vix.com/. This is a database maintained in DNS of spammers. To use this database, use

Contact MAPS to subscribe ( http://mail-abuse.org/ ).

You can specify an alternative RBL server to check by specifying an argument to the FEATURE. The default error message is

        Mail from IP-ADDRESS refused by blackhole site SERVER

        451 Temporary lookup failure of IP-ADDRESS at SERVER

This FEATURE can be included several times to query different DNS based rejection lists, e.g., the dial-up user list (see http://mail-abuse.org/dul/ ).

Notice: to avoid checking your own local domains against those blacklists, use the access_db feature and add:

        Connect:10.1            OK
        Connect:127.0.0.1       RELAY

The features described above make use of the check_relay, check_mail, and check_rcpt rulesets. If you wish to include your own checks, you can put your checks in the rulesets Local_check_relay, Local_check_mail, and Local_check_rcpt. For example if you wanted to block senders with all numeric usernames (i.e. 2312343@bigisp.com), you would use Local_check_mail and the regex map:

	LOCAL_CONFIG
	Kallnumbers regex -a@MATCH ^[0-9]+$

	LOCAL_RULESETS
	SLocal_check_mail
	# check address against various regex checks
	R$*				$: $>Parse0 $>3 $1
	R$+ < @ bigisp.com. > $*	$: $(allnumbers $1 $)
	R@MATCH				$#error $: 553 Header Error

Finer control by using tags for the LHS of the access map Read this section only if the options listed so far are not sufficient for your purposes. There is now the option to tag entries in the access map according to their type. Three tags are available:

	Connect:	connection information (${client_addr}, ${client_name})
	From:		envelope sender
	To:		envelope recipient

	From:spammer@some.dom	REJECT
	To:friend.domain	RELAY
	Connect:friend.domain	OK
	Connect:from.domain	RELAY
	From:good@another.dom	OK
	From:another.dom	REJECT

Delay all checks

If check_mail returns an error then the RCPT TO command will be rejected with that error. If it returns some other result starting with $# then check_relay will be skipped. If the sender address (or a part of it) is listed in the access map and it has a RHS of OK or RELAY, then check_relay will be skipped. This has an interesting side effect: if your domain is my.domain and you have

	my.domain	RELAY

	To:my.domain		RELAY
	Connect:my.domain	RELAY

	To:abuse@	SPAMFRIEND

	To:abuse@abuse.my.domain	SPAMFRIEND
	To:me+abuse@		SPAMFRIEND

	LOCAL_RULESETS
	HMessage-Id: $>CheckMessageId
	SCheckMessageId
	R< $+ @ $+ >		$@ OK
	R$*			$#error $: 553 Header Error

	HSubject: $>+CheckSubject

After all of the headers are read, the check_eoh ruleset will be called for any final header-related checks. The ruleset is called with the number of headers and the size of all of the headers in bytes separated by $|. One example usage is to reject messages which do not have a Message-Id: header. However, the Message-Id: header is *NOT* a required header and is not a guaranteed spam indicator. This ruleset is an example and should probably not be used in production.

この画面は jeedosaquin を使って表示しています。

Copyright cf Project