[prev in list] [next in list] [prev in thread] [next in thread] 

List:       spamassassin-users
Subject:    Re: SpamAssassin Rules Regarding Abuse of New Top Level Domains
From:       Paul Stead <paul.stead () zeninternet ! co ! uk>
Date:       2015-10-21 9:36:15
Message-ID: 56275C8F.3080604 () zeninternet ! co ! uk
[Download RAW message or body]


On 20/10/15 21:10, Axb wrote:
> On 10/20/2015 10:04 PM, RW wrote:
>> On Tue, 20 Oct 2015 13:29:45 -0500 (CDT)
>> shanew@shanew.net wrote:
>>
>>
>>> I already have rules that score for these tlds in received or envelope
>>> from, but I'm getting tired of making the regular expression longer
>>> and longer (in two different places), and I know there's a smarter
>>> way.  Whether I'm smart enough to implement that smarter way is
>>> another matter entirely.
>>>
>>> Is there an existing (relatively simple) plugin that behaves similarly
>>> that I could crib from?
>>
>
> or put a choice of wildcarded TLDs in a rbldnsd zone and use a header
> check_rbl_envfrom rule for senders and URIBL.pm plugin lookups
>
Another way to achieve this, without rbldnsd etc, just need to make sure
WLBLEval is enabled:

loadplugin Mail::SpamAssassin::Plugin::WLBLEval

enlist_uri_host (NEWSPAMMY) date
enlist_uri_host (NEWSPAMMY) win
enlist_uri_host (NEWSPAMMY) faith
enlist_uri_host (NEWSPAMMY) racing

These can then be used with eval rules:

To check all URIs:

header   PDS_OTHER_BAD_TLD eval:check_uri_host_listed('NEWSPAMMY')
score    PDS_OTHER_BAD_TLD 0.1
describe PDS_OTHER_BAD_TLD Other untrustworthy TLDs

if you just want to check From address:

header   PDS_OTHER_BAD_TLD eval:check_from_in_list('NEWSPAMMY')


--
Paul Stead
Systems Engineer
Zen Internet
[prev in list] [next in list] [prev in thread] [next in thread]