Hi,
Wanting to get some input for using wildcard domains in sender_access. I am pulling my hair out - what am I doing wrong? Any suggestions for testing this in a better manner?
Not sure if I am not reading the documentation correctly or if I haven’t had enough caffeine but any input as to what I am missing/misreading would be super helpful.
My key assumption is that if I use an entry such as (below) then anything from that domain will get discarded. eg that this will remove mary@exampledomain.com, fred@exampledomain.com and bob@mail.exampledomain.com
.exampledomain.com. DISCARD
Background:
Full settings on how I set this up are here in my earlier post
Specific example with the headers is below:
I have blocked
.keepfamilyhealth.com DISCARD
The headers are:
Return-Path: <bounce@keepfamilyhealth.com>
Delivered-To: peter@bluetardis.com.au
Received: from box.bluetardis.com.au ([127.0.0.1])
by box.bluetardis.com.au with LMTP id mAu7MrggAWSJCwAA3LfvEA
for <peter@bluetardis.com.au>; Fri, 03 Mar 2023 09:18:32 +1100
X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on
box.bluetardis.com.au
X-Spam-Level: ***
X-Spam-Status: No, score=3.9 required=5.0 tests=BAYES_99,BAYES_999,DKIM_SIGNED,
DKIM_VALID,DKIM_VALID_AU,DMARC_PASS,HTML_MESSAGE,RCVD_IN_MSPIKE_H2,
SPF_HELO_NONE,SPF_PASS,T_KAM_HTML_FONT_INVALID,UNPARSEABLE_RELAY,
URI_NOVOWEL autolearn=no autolearn_force=no version=3.4.2
X-Spam-Report:
* 0.2 BAYES_999 BODY: Bayes spam probability is 99.9 to 100%
* [score: 1.0000]
* 3.5 BAYES_99 BODY: Bayes spam probability is 99 to 100%
* [score: 1.0000]
* -0.1 DMARC_PASS DMARC check passed
* -0.1 SPF_PASS SPF check passed
* 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record
* -0.0 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2)
* [194.9.86.110 listed in wl.mailspike.net]
* 0.5 URI_NOVOWEL URI: URI hostname has long non-vowel sequence
* 0.0 HTML_MESSAGE BODY: HTML included in message
* -0.1 DKIM_VALID_AU Message has a valid DKIM or DK signature from
* author's domain
* -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
* 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
* valid
* 0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay
* lines
* 0.0 T_KAM_HTML_FONT_INVALID Test for Invalidly Named or Formatted
* Colors in HTML
X-Spam-Score: 3.9
Received: from relay280.mysmtp3.com (relay280.mysmtp3.com [194.9.86.110])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits))
(No client certificate requested)
by box.bluetardis.com.au (Postfix) with ESMTPS id 8DA297D008
for <peter@bluetardis.com.au>; Fri, 3 Mar 2023 09:18:30 +1100 (AEDT)
Authentication-Results: box.bluetardis.com.au; dmarc=pass (p=none dis=none) header.from=keepfamilyhealth.com
Authentication-Results: box.bluetardis.com.au; spf=pass smtp.mailfrom=bounce@keepfamilyhealth.com
Authentication-Results: box.bluetardis.com.au;
dkim=pass (1024-bit key; unprotected) header.d=keepfamilyhealth.com header.i=@keepfamilyhealth.com header.b="GxJfymMh";
dkim-atps=neutral
Received: from [non-disclosed] for <peter@bluetardis.com.au>; Thu, 2 Mar 2023 23:04:12 +0100 (CET)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=keepfamilyhealth.com;
s=mysmtp; t=1677794652;
bh=U/ke4cIKAEhPVWcIiq/BGjL4QhjJOqTwpy7sg4Hhps0=;
h=Date:Subject:From:Reply-To:To:From;
b=GxJfymMhZJFAWdWy/FgAqQm9gCv4IxfbgkBKpmh7r/ztG7KR1yuNgmd9msu2LjZfm
+9OZjCt9gY3oFn8XtGJ94ZI5isN0BrP92bfrYaB+yXl7FpboN4Kw3cR1LZK+qdxVzk
5qjOMYUtseUB4E7Tg4I+OwuoPCxZ+WWOsJoEfHv8=
Message-ID: <2-82xsoNd4Fig6-cJzOpv78g8g5@keepfamilyhealth.com>
Date: Thu, 02 Mar 2023 22:04:11 +0000
Subject: regrow your healthy, thick hair in just 30 days.
From: This method <denise@keepfamilyhealth.com>
Reply-To: support@keepfamilyhealth.com
To: peter@bluetardis.com.au
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="_=_swift_1677794651_109d1dfdd1686b50b1a8b0e05ad3a241_=_"
x-var: 125106703-78253166-1105-740-572-952-2
x-logid: 125106703
X: eyJhbGciOiJBMTI4S1ciLCJlbmMiOiJBMTI4Q0JDLUhTMjU2In0.IWlWItcM_v5kym8Jr6PLV_y-GzJQ79R6RVKPTgAQZroRm2STxdUESw.UM6Nmdgmheks-v6k1vj43g.yaDwDRhyL8lAzBe_Z3E7cRyClcI9G-VodiTDBO8alZKgOPbsg6Hta8OGAZZ-yCzaETCruQl-pUvHE-q3oqRCDOWK1JbjrkSBlzD8LrjyZQDQ8cBvS2P4jaqpul6n-GJhQ_mOLBm0P02pn8zJZwWtWSnZgmldlOLOCuEa7oJuZX2t7YlcNALWOS6BY4DW0TPJBrH9uhVM1OyQXfLSsl__KtNEv29fJjMUD5vKzEC3lxEMnl2oEKZTwb4tId9RnagivXfLokaLkrZDtSzOQYTYBw.8UZz4i1M2j4pjG2e6tQomQ
The fix for me was to make the following changes:
open the main configuration file.
sudo nano /etc/postfix/main.cf
Add the following line at the end of the file.
Note: this uses PCRE rather than RegEx. Must faster for humans to setup.
header_checks = pcre:/etc/postfix/header_checks
Save and close the file.
Create the /etc/postfix/header_checks lookup file with a command line text editor such as Nano.
sudo nano /etc/postfix/header_checks
You can add regular expression checking like below.
/free credit quote/ DISCARD
/.stupidspammerdomain.com/ DISCARD
Once you finish editing the header_checks lookup file, you need to build the index file.
sudo postmap /etc/postfix/header_checks
Then restart Postfix for the changes to take effect.
sudo systemctl restart postfix
Testing is easy enough: start with an external email address you own and blockit eg myotheraddress@gmail.com
Watch the logs and tweak as needed.
sudo tail -f /var/log/mail.log