Quick question (joe-job?)

[Wallaby]

I'm sure this is an easy one.

One of our domains, call it mydomain.com, receives a lot of spam sent from a falsified address, eg [email protected], and Spam Assassin seems to classify all such mail as "non-spam" regardless -- the spam score is a big negative number.

What I want to know is if there is a simple way to tell Exim: "If mail for mydomain.com has a sender address [email protected] but the orginating server is not *this* server, throw it away".

I'd rather not go down the route of using SPF for this.

 

[mctDarren]

Have a look into the exim filter file (located at /etc/antivirus.exim). You can write up a quick rule there and change the Exim configuration to point to that instead of /etc/antivirus.empty.

 

[kemis]

Be sure to read my "update" at the end of this post!

MailScanner has a feature called "watermarking" that does exactly what you're wanting.

When reading about its features, you'd think that it's a Godsend. Enable the setting, and suddenly all those joe-job e-mails are marked as spam (you can even tell MailScanner to discard them completely).

PROBLEM (the catch): You cannot currently set this "per domain", and you'll find that other users will begin complaining that certain legit e-mails (like out of office replies) are marked as spam, too.

In the end, I've had to disable watermarking & just tell my unlucky joe-job recipients to wait it out.

If there were a way in MailScanner to enable watermarking, but only enforce certain rules on certain domains, I'd be all in as this being the solution. Like I said, though, it's currently an all or nothing setting.

Matt

UPDATE: I was wrong! You CAN specify a ruleset for several different watermarking settings. Therefore, you can enable or disable watermarking behavior per domain. Sorry for any confusion - Go get MailScanner from ConfigServer!