procmail
[Top] [All Lists]

Using Procmail for RBL Blacklists

2003-03-28 10:22:05
I tried to find something about this in the archives, but wasn't successful.
I'm using procmail to filter by various blacklists. I'm using code I mostly
swiped from Catherine Hampton's spambouncer, but I've seen similar code in
other places. Here's the relevant bit:

:0
* ()\/Received: from.*
{
        CHECK=${MATCH}
        :0
        *$  CHECK ?? Received: from.*\[.*\].*by.*${HOST}
        *$! CHECK ?? Received: from.*${HOST}.*\[.*\]
        *$  CHECK ?? Received:.*\[\/[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+
        {
                CHECKIP=${MATCH}
        }
}

It then repeats that twice more.

This gives it an IP that it has received the e-mail from and then goes on to
check it against the blacklists. It works fine for mail that's sent directly
to my server. The problem is that lots of spammers send mail through the
backup MX server, and when this happens, this code checks the IP of the backup
MX, not the server the backup got it from. I can't figure out how to get the
recipe to treat both as trusted. Is there some way I can insert an OR
statement in there or something so that it also checks for the backup server
when it checks for HOST? I tried various permutations of this:

*$! CHECK ?? Received: from.*${BACKUPHOST}

But I've not managed to get it to work. Any obvious way of accomplishing this?

--
----------------------------------------------------------------------------
Kim Scarborough                                  http://www.unknown.nu/kim/
----------------------------------------------------------------------------
"If you tell the same story five times, it's true."
                                                             - Larry Speakes
----------------------------------------------------------------------------
Now listening to: Mr. Bungle - "Violenza Domestica"
----------------------------------------------------------------------------



_______________________________________________
procmail mailing list
procmail(_at_)lists(_dot_)RWTH-Aachen(_dot_)DE
http://MailMan.RWTH-Aachen.DE/mailman/listinfo/procmail

<Prev in Thread] Current Thread [Next in Thread>