Re: Create a rule to block MAX recipients

Le mercredi 06 avril 2011 à 16:05 -0300, Eduardo Casarero a écrit :
>
>
> 2011/4/6 David Touzeau <david@touzeau.eu>
> Dear All
>
> I would like to create a rune in order to block messages that
> contains
> more than X recipients in Spamassassin from these fields
>
> To:
> CC:
> Bcc:
>
> This without any MTA help
>
> How can i do this
>
> Best regards ?
>
> In 2009 i wrote this email to the MailScanner List answering something
> like your issue, maybe is a good approach, or may be not. I didnt test
> this rule on production servers.
>
>
> -----------------------------------
>
>
> Some time ago i wrote this rule for SpamAssassin, i didnt test it a
> lot, so test it with precaution. I was for someone with the same
> problem than you.
>
> the logic of the rule is that if the email has more than
> 10 recipients at least 1 rule will hit, with combination is probable
> than more than one hits. you can also generate a new meta rule to have
> only 1 hit with an OR.
>
> header __TEST_TO_1 To =~ /(.*?(@).*?){1,}/i
> header __TEST_TO_2 To =~ /(.*?(@).*?){2,}/i
> header __TEST_TO_3 To =~ /(.*?(@).*?){3,}/i
> header __TEST_TO_4 To =~ /(.*?(@).*?){4,}/i
> header __TEST_TO_5 To =~ /(.*?(@).*?){5,}/i
> header __TEST_TO_6 To =~ /(.*?(@).*?){6,}/i
> header __TEST_TO_7 To =~ /(.*?(@).*?){7,}/i
> header __TEST_TO_8 To =~ /(.*?(@).*?){8,}/i
> header __TEST_TO_9 To =~ /(.*?(@).*?){9,}/i
> header __TEST_TO_10 To =~ /(.*?(@).*?){10,}/i
>
> header __TEST_CC_1 Cc =~ /(.*?(@).*?){1,}/i
> header __TEST_CC_2 Cc =~ /(.*?(@).*?){2,}/i
> header __TEST_CC_3 Cc =~ /(.*?(@).*?){3,}/i
> header __TEST_CC_4 Cc =~ /(.*?(@).*?){4,}/i
> header __TEST_CC_5 Cc =~ /(.*?(@).*?){5,}/i
> header __TEST_CC_6 Cc =~ /(.*?(@).*?){6,}/i
> header __TEST_CC_7 Cc =~ /(.*?(@).*?){7,}/i
> header __TEST_CC_8 Cc =~ /(.*?(@).*?){8,}/i
> header __TEST_CC_9 Cc =~ /(.*?(@).*?){9,}/i
> header __TEST_CC_10 Cc =~ /(.*?(@).*?){10,}/i
>
> #just for testing purposes
> #meta TEST_TO_1_CC_1 (__TEST_TO_1 && __TEST_CC_1)
> #
>
> meta TEST_TO_1_CC_9 (__TEST_TO_1 && __TEST_CC_9)
> meta TEST_TO_2_CC_8 (__TEST_TO_2 && __TEST_CC_8)
> meta TEST_TO_3_CC_7 (__TEST_TO_3 && __TEST_CC_7)
> meta TEST_TO_4_CC_6 (__TEST_TO_4 && __TEST_CC_6)
> meta TEST_TO_5_CC_5 (__TEST_TO_5 && __TEST_CC_5)
> meta TEST_TO_6_CC_4 (__TEST_TO_6 && __TEST_CC_4)
> meta TEST_TO_7_CC_3 (__TEST_TO_7 && __TEST_CC_3)
> meta TEST_TO_8_CC_2 (__TEST_TO_8 && __TEST_CC_2)
> meta TEST_TO_9_CC_1 (__TEST_TO_9 && __TEST_CC_1)
> meta TEST_TO_10_CC_0 (__TEST_TO_10)
> meta TEST_TO_10_CC_0 (__TEST_CC_10)
>
> score TEST_TO_1_CC_1 0.01
> score TEST_TO_1_CC_9 0.01
> score TEST_TO_2_CC_8 0.01
> score TEST_TO_3_CC_7 0.01
> score TEST_TO_4_CC_6 0.01
> score TEST_TO_5_CC_5 0.01
> score TEST_TO_6_CC_4 0.01
> score TEST_TO_7_CC_3 0.01
> score TEST_TO_8_CC_2 0.01
> score TEST_TO_9_CC_1 0.01
> score TEST_TO_10_CC_0 0.01
> score TEST_TO_0_CC_10 0.01
>
> hope it helps!
>
>

Many thanks all !!!

I love
 the Spamassassin community !

• This message: [ Message body ]
• Next message: Julian Yap: "SpamCop and false positives from Yahoo"
• Previous message: David B Funk: "Re: RCVD_IN_SORBS_DUL on my own emails to self"
• In reply to: Eduardo Casarero: "Re: Create a rule to block MAX recipients"
• Next in thread: John Hardin: "Re: Create a rule to block MAX recipients"

• Contemporary messages sorted: [ By Date ] [ By Thread ] [ By Subject ] [ By Author ]