Mailing List Archive: SpamAssassin: users

How to reject spam where sender = receiver

Index | Next | Previous | View Threaded

tvtb at bgtelecom

Oct 27, 2009, 4:36 PM

Post #1 of 9 (1480 views)
Permalink

How to reject spam where sender = receiver

My spamassassin plug doesn't check mail where sender address and receiver
address are equal. Like this

Return-Path: <op [at] domen>
X-Spam-Status: No, hits=0.0 required=3.2
tests=DNSBL_RELAYS.ORDB.ORG: 5.00,DNSBL_BL.SPAMCOP.NET:
5.00,DNSBL_SBL-XBL.SPAMHAUS.ORG: 5.00,
BAYES_99: 4.07,HELO_DYNAMIC_IPADDR2: 3.818,HTML_IMAGE_ONLY_32:
1.052,
HTML_MESSAGE: 0.001,MIME_HTML_ONLY: 0.001,NO_REAL_NAME: 0.961,
URIBL_AB_SURBL: 3.812,URIBL_JP_SURBL: 4.087,URIBL_OB_SURBL: 3.008,
URIBL_SBL: 1.639,URIBL_SC_SURBL: 4.498,URIBL_WS_SURBL: 2.14,
CUSTOM_RULE_FROM: ALLOW,TOTAL_SCORE: 44.087
X-Spam-Level:
Received: from 75-148-3-221-WashingtonDC.hfc.comcastbusiness.net
([75.148.3.221])
by mail.tvtb.ru
for op [at] domen;
Sun, 25 Oct 2009 07:53:00 +1000
To: operzal [at] tvtb
Subject: A path leading to your well-being
From: <op [at] domen>
MIME-Version: 1.0
Importance: High
Content-Type: text/html

How can I create a new rule which will check equity fields TO and FROM ???
--
View this message in context: http://www.nabble.com/How-to-reject-spam-where-sender-%3D-receiver-tp26086971p26086971.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

jhardin at impsec

Oct 27, 2009, 4:58 PM

Post #2 of 9 (1448 views)
Permalink

Re: How to reject spam where sender = receiver [In reply to]

On Tue, 27 Oct 2009, rpc1 wrote:

>
> My spamassassin plug doesn't check mail where sender address and receiver
> address are equal. Like this
>
> Return-Path: <op [at] domen>
> X-Spam-Status: No, hits=0.0 required=3.2
> tests=DNSBL_RELAYS.ORDB.ORG: 5.00,DNSBL_BL.SPAMCOP.NET:
> 5.00,DNSBL_SBL-XBL.SPAMHAUS.ORG: 5.00,
> BAYES_99: 4.07,HELO_DYNAMIC_IPADDR2: 3.818,HTML_IMAGE_ONLY_32:
> 1.052,
> HTML_MESSAGE: 0.001,MIME_HTML_ONLY: 0.001,NO_REAL_NAME: 0.961,
> URIBL_AB_SURBL: 3.812,URIBL_JP_SURBL: 4.087,URIBL_OB_SURBL: 3.008,
> URIBL_SBL: 1.639,URIBL_SC_SURBL: 4.498,URIBL_WS_SURBL: 2.14,
> CUSTOM_RULE_FROM: ALLOW,TOTAL_SCORE: 44.087
> X-Spam-Level:
> Received: from 75-148-3-221-WashingtonDC.hfc.comcastbusiness.net
> ([75.148.3.221])
> by mail.tvtb.ru
> for op [at] domen;
> Sun, 25 Oct 2009 07:53:00 +1000
> To: operzal [at] tvtb
> Subject: A path leading to your well-being
> From: <op [at] domen>
> MIME-Version: 1.0
> Importance: High
> Content-Type: text/html
>
> How can I create a new rule which will check equity fields TO and FROM ???

I would suggest that is not really what you want to do, as you'll rarely
see that on spam that isn't addressed to your domain. What you probably
want to do is reject mail that is claiming to be from your domain, but
does not actually originate from your domain - in other words, mail where
someone is forging your domain name on the sender address.

Is that a better description of what you want to do?

That has been covered several times, I am pretty sure within the last
month. Please check the list archives for the past two months for a thread
having a subject like "to = from". You'll find a discussion of setting up
an SPF record for your domain and using whitelist_from_auth to enforce it,
and another discussion (involving me) of using milter-regex to reject such
forged sender addresses at SMTP time. Both methods work well, I would
modestly say milter-regex works better because it bypasses SA and is thus
a lighter solution overall.

<mutter>Maybe I should throw a rule like that into the sandbox and see how
well it does...</mutter>

--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhardin [at] impsec FALaholic #11174 pgpk -a jhardin [at] impsec
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
...the Fates notice those who buy chainsaws...
-- www.darwinawards.com
-----------------------------------------------------------------------
4 days until Halloween

ilikeuce at bornefeld-ettmann

Oct 27, 2009, 6:20 PM

Post #3 of 9 (1448 views)
Permalink

Re: How to reject spam where sender = receiver [In reply to]

John Hardin schrieb:
> On Tue, 27 Oct 2009, rpc1 wrote:
>
>>
>> My spamassassin plug doesn't check mail where sender address and receiver
>> address are equal. Like this
>>
>> Return-Path: <op [at] domen>
>> X-Spam-Status: No, hits=0.0 required=3.2
>> tests=DNSBL_RELAYS.ORDB.ORG: 5.00,DNSBL_BL.SPAMCOP.NET:
>> 5.00,DNSBL_SBL-XBL.SPAMHAUS.ORG: 5.00,
>> BAYES_99: 4.07,HELO_DYNAMIC_IPADDR2: 3.818,HTML_IMAGE_ONLY_32:
>> 1.052,
>> HTML_MESSAGE: 0.001,MIME_HTML_ONLY: 0.001,NO_REAL_NAME: 0.961,
>> URIBL_AB_SURBL: 3.812,URIBL_JP_SURBL: 4.087,URIBL_OB_SURBL: 3.008,
>> URIBL_SBL: 1.639,URIBL_SC_SURBL: 4.498,URIBL_WS_SURBL: 2.14,
>> CUSTOM_RULE_FROM: ALLOW,TOTAL_SCORE: 44.087
>> X-Spam-Level:
>> Received: from 75-148-3-221-WashingtonDC.hfc.comcastbusiness.net
>> ([75.148.3.221])
>> by mail.tvtb.ru
>> for op [at] domen;
>> Sun, 25 Oct 2009 07:53:00 +1000
>> To: operzal [at] tvtb
>> Subject: A path leading to your well-being
>> From: <op [at] domen>
>> MIME-Version: 1.0
>> Importance: High
>> Content-Type: text/html
>>
>> How can I create a new rule which will check equity fields TO and
>> FROM ???
>
> I would suggest that is not really what you want to do, as you'll rarely
> see that on spam that isn't addressed to your domain. What you probably
> want to do is reject mail that is claiming to be from your domain, but
> does not actually originate from your domain - in other words, mail
> where someone is forging your domain name on the sender address.
>
> Is that a better description of what you want to do?
>
> That has been covered several times, I am pretty sure within the last
> month. Please check the list archives for the past two months for a
> thread having a subject like "to = from". You'll find a discussion of
> setting up an SPF record for your domain and using whitelist_from_auth
> to enforce it, and another discussion (involving me) of using
> milter-regex to reject such forged sender addresses at SMTP time. Both
> methods work well, I would modestly say milter-regex works better
> because it bypasses SA and is thus a lighter solution overall.
>
> <mutter>Maybe I should throw a rule like that into the sandbox and see
> how well it does...</mutter>
>

If you do not like SPF and you do not have remote users who are allowed
to send mail with local domain you can add a rule to header checks.

e.g Postfix :

/etc/postfix/header_checks :

/^From:.*example\.com/ REJECT

Cheers
Ralph

me at junc

Oct 27, 2009, 9:25 PM

Post #4 of 9 (1441 views)
Permalink

Re: How to reject spam where sender = receiver [In reply to]

On ons 28 okt 2009 00:36:10 CET, rpc1 wrote

> My spamassassin plug doesn't check mail where sender address and receiver
> address are equal. Like this

http://www.nabble.com/postfwd-stop-equal-sender-recipient-spams-td21164908.html

or setup spf for your domain and test with spf in your mta

i do the later now, but if you dont want to use spf, use the postfwd rule

--
xpoint

antispam at khopis

Oct 28, 2009, 7:42 AM

Post #5 of 9 (1440 views)
Permalink

Re: How to reject spam where sender = receiver [In reply to]

Benny Pedersen wrote:
> On ons 28 okt 2009 00:36:10 CET, rpc1 wrote
>
>> My spamassassin plug doesn't check mail where sender address and receiver
>> address are equal. Like this
>
> http://www.nabble.com/postfwd-stop-equal-sender-recipient-spams-td21164908.html
>
> or setup spf for your domain and test with spf in your mta
>
> i do the later now, but if you dont want to use spf, use the postfwd rule

I scored that 0.1 ... rejecting based on sender==recipient would
effectively be scoring it far higher, and would most certainly reject
legitimate mail (lots of people send announcements via Bcc or Cc while
addressing the message back to themselves).

Also, SPF only works for domains you control iff the sender were
forging one of them. My plugin maches username1 [at] domain to
username2 [at] domain if username1 == username2 regardless of domain.

me at junc

Oct 28, 2009, 7:46 AM

Post #6 of 9 (1438 views)
Permalink

Re: How to reject spam where sender = receiver [In reply to]

On ons 28 okt 2009 15:42:19 CET, Adam Katz wrote

[snip]
> forging one of them. My plugin maches username1 [at] domain to
> username2 [at] domain if username1 == username2 regardless of domain.

legit users can not use smtp auth ?, hmm :)

--
xpoint

jarif at iki

Oct 28, 2009, 8:47 AM

Post #7 of 9 (1437 views)
Permalink

Re: How to reject spam where sender = receiver [In reply to]

28.10.2009 16:42, Adam Katz kirjoitti:
>
> I scored that 0.1 ... rejecting based on sender==recipient would
> effectively be scoring it far higher, and would most certainly reject
> legitimate mail (lots of people send announcements via Bcc or Cc while
> addressing the message back to themselves).
>

Thanks for the plugin! I scored it as 1.0, and it definitely hits most
of my spam.

I sometimes send notes to myself, but 1.0 is not dangerous yet.

--
http://www.iki.fi/jarif/

Tomorrow will be cancelled due to lack of interest.

Attachments:

signature.asc (0.25 KB)

antispam at khopis

Oct 28, 2009, 1:48 PM

Post #8 of 9 (1437 views)
Permalink

Re: How to reject spam where sender = receiver [In reply to]

Jari Fredriksson wrote:
> 28.10.2009 16:42, Adam Katz kirjoitti:
>> I scored that 0.1 ... rejecting based on sender==recipient would
>> effectively be scoring it far higher, and would most certainly reject
>> legitimate mail (lots of people send announcements via Bcc or Cc while
>> addressing the message back to themselves).
>
> Thanks for the plugin! I scored it as 1.0, and it definitely hits most
> of my spam.
>
> I sometimes send notes to myself, but 1.0 is not dangerous yet.

The only data we have on this at the moment is my own S/O of 0.665,
which (as John mentioned) is rather mild. I wouldn't push it beyond
0.75 on the aggressive side.

tvtb at bgtelecom

Oct 28, 2009, 3:59 PM

Post #9 of 9 (1432 views)
Permalink

Re: How to reject spam where sender = receiver [In reply to]

Thanks for useful answers !!!
--
View this message in context: http://www.nabble.com/How-to-reject-spam-where-sender-%3D-receiver-tp26086971p26103651.html
Sent from the SpamAssassin - Users mailing list archive at Nabble.com.

Index | Next | Previous | View Threaded

Interested in having your list archived? Contact Gossamer Threads