Re: spammers tacking on headers how to block?

15 msg	Header for message size?
3 msg	address rewriting
2 msg	address_verify_relayhost and relay_domains
5 msg	pflogsumm reports
11 msg	Changing Queue IDs
3 msg	another authentication failure( with sasl)
2 msg	Bypass Spam checks for certain destinations
11 msg	Postfix 'too nice' with content_filter
7 msg	profiling a milter (dkim in particular)

spammers tacking on headers how to block?
\ jjones (19 Sep 2007)
. \ Evan Platt (19 Sep 2007)
. . \ jjones (19 Sep 2007)
. . . \ mouss (3 Oct 2007)
. . \ Gaby Vanhegan (19 Sep 2007)
. \ Terry Carmen (19 Sep 2007)
. \ mouss (19 Sep 2007)

7 msg	[Fwd: Re: RFC 821]
1 msg	Re:
4 msg	(No Subject)
2 msg	RFC 821
7 msg	Suspending mail delievery to a specific user
2 msg	Re: OT - massive newsletter
12 msg	List management issue: possibly Off Topic
2 msg	bad protocol error Testing SASL configuration
2 msg	warning: smtpd_sasl_auth_enable is true, but SA...
1 msg	Quota Problem

Subject:	Re: spammers tacking on headers how to block?
Group:	Postfix-users
From:	mouss
Date:	19 Sep 2007

jjones wrote:
> Hello all,
>
> I have had a real good success with postfix + spamassassin for a spam tagging gateway, but a spammer is getting crafty and tacking on headers in the email. I was wondering if anyone can see a easy of blocking these types of emails.
>

do you mean the Received with "mx.freenet.de"? you cannot block this
with header_checks because there is no way to check only the first
received header, and even if it was possible, there is no way to compare
its text to the client or to the helo hostname.

you can use something like this (please understand it before using it.
use at your own risk anyway).

smtpd_recipient_restrictions =
...
check_helo_access pcre:/etc/postfix/dynlike

smtpd_restriction_classes =
...
policy_aggressive

policy_aggressive =
reject_unknown_helo_hostname
reject_rbl_client bl.spamcop.net

== dynlike:
/[^a-z]{9}/ policy_aggressive
endif

The rationale is that "nobody" would helo with a name that contains 9
consecutive non alphanumeric characters, so collateral damage should be
limited.

or you could just use spamcop globally and configure rbl_reply_maps so
that the reject code for spamcops is a 4xx. Then check your logs and see
fi some IPs should be whitelisted. spamcop seems to be safer than it
once was. but it's your server, so make your own judgement.