Exim Filter To block Outgoing Email

[Osama Tariq]

The thing i want is to block outgoing-email(means outside from domainone.com) of specific user and send the copy of outgoing email to [email protected].
I have tried alot and manupuliate below acl, but all my efforts were in vein.

if $sender_address is "[email protected]"
and ("$h_to:" does not matches "domainone.com")
or ("$h_cc:" does not matches "domainone.com")
or ("$h_bcc:" does not matches "domainone.com")
then
  unseen deliver [email protected]
  fail text "This message has been rejected"
seen finish
endif

 

[cPanelMichael]

Hello,

You may want to develop a custom rule that utilizes part of the workaround instructions referenced on the following thread:

SOLVED - How Do I Block One Domain From Sending Email From My Server?

Thank you.

 

[Osama Tariq]

The link you have mentioned is not related to my question. I want to send internal domain email for specific address and if he sent out of domain than the mail is rejected and sent copy to [email protected].

 

[cPanelMichael]

Hello,

Could you let us know how you are adding the custom filter rule? You mentioned a custom ACL, however you'd want to setup the custom filter for outgoing email using the instructions on the following document:

How to Customize the Exim System Filter File - cPanel Knowledge Base - cPanel Documentation

Thank you.

 

[Osama Tariq]

Yes i want to add a custom filter rule. I tried the above mentioned filter but its not working properly.

 

[cPanelMichael]

Hello,

What's the output from /var/log/exim_mainlog when you send a test message designed to trigger that filter rule? Also, could you outline the specific steps you have taken thus far to implement that custom filter rule?

Thank you.

 

[Osama Tariq]

When i sent email other that domainone.com:

2017-03-24 22:33:40 SMTP connection from [::1]:47267 (TCP/IP connection count = 1)
2017-03-24 22:33:41 1crT5o-00027x-NT <= [email protected] H=([IP]) [::1]:47267 P=esmtpa A=dovecot_login:
[email protected]
S=704 [email protected] T="check email" for [email protected]
2017-03-24 22:33:41 SMTP connection from ([IP) [::1]:47267 closed by QUIT
2017-03-24 22:33:41 cwd=/var/spool/exim 3 args: /usr/sbin/exim -Mc 1crT5o-00027x-NT
2017-03-24 22:33:41 1crT5o-00027x-NT SMTP connection outbound 1490376821 1crT5o-00027x-NT domainone [email protected]
2017-03-24 22:33:43 1crT5o-00027x-NT => [email protected] R=dkim_lookuphost T=dkim_remote_smtp H=aspmx.l.google.com [74.125.133.27] X=TLSv1.2:ECDHE-RSA-AES128-GCM-SHA256:128 CV=yes C="250 2.0.0 OK 1490376753 i21si3476307wrc.136 - gsmtp"
2017-03-24 22:33:43 1crT5o-00027x-NT Completed

 

[cPanelMichael]

Hello,

Could you also outline the specific steps you have taken thus far to implement that custom filter rule?

Thank you.

 

[Osama Tariq]

Right now this filter is not working properly. Any email id with Domainone is unable to sent email outside that domain, just block and sent email to unseen address.
Actually instead of any email id it should only block [email protected] email id to sent email outside that Domainone and if cc and bbc matches to Domainone that it allows only cc/bcc.

if $sender_address is "[email protected]"
and ("$h_to:" does not matches "Domainone")
or ("$h_cc:" does not matches "Domainone")
or ("$h_bcc:" does not matches "Domainone")
then
  unseen deliver [email protected]
  fail text "This message has been rejected"
seen finish
endif

TO:
x[email protected]
This message has been rejected
CC:
c[email protected]
This message has been rejected

CC email should be deliver because it's same domain address.

 

[cPanelMichael]

Hello,

Could you open a support ticket using the link in my signature so we can review the affected system and take a closer look at what's happening? You can post the ticket number here so we can update this thread with the outcome.

Thank you.

 

[Osama Tariq]

That is not the affected system, its just to implement filter.

 

[cPanelMichael]

Hello,

Custom Exim filter rules are unsupported, but I do see other examples of this type of filter referenced on the following thread:

Hidden copies of incoming and outgoing emails

You may need to post your question to the Exim users mailing list or consult with a system administrator if you don't receive sufficient user-feedback to your custom rule request:

Exim-users Info Page
System Administration Services | cPanel Forums

Thank you.