Our spam/virus filtering platform works extremely well, with very few false positives, and a very small number of false negatives. Being based around the Exim4 MTA, backed onto amavisd-new, together with SpamAssassin, ClamAV, Trawler (http://trawler.sf.net), ContFilter (http://contfilter.sf.net) and HoneySigger (http://honeysigger.sf.net). Whilst we block the majority of spam and virus content, running all of these daemons and processes against every email is very processor intensive.
Having crafted a couple of simple Exim ACLs in the past which detect simple things like HELO spoofing of the servers hostname, I spent a couple of hours adding to these, adding all manner of rules that will turn spam away at the door – rather than having to go through the whole process of unpacking emails and scanning them.
Beforehand, the Exim logs were mostly full of ContFilter warnings “This message was rejected because the banned word ‘viagra’ was found in the message subject”. Following the addition of these new rules, there is very little email reaching the stage of being scanned.
Below is an extract of the current state of my Exim ACL configuration:
warn message = X-sender-localhost: Sender claims to be ‘localhost’ but they are not me!
log_message = Sender MX claims to be ‘localhost’ but they are not!
!hosts = localhost
condition = ${if match{$sender_helo_name}{localhost}{yes}{no}}
deny message = Sender claims to have a local address, but is not authenticated nor relayed (try using SMTP-AUTH!)
log_message = Forged Sender address (claims to be local user [${sender_address}], but isn’t authenticated)
!hosts = +relay_from_hosts
!authenticated = *
condition = ${if match_domain{$sender_address_domain}{+local_domains}}
drop
log_message = Drop connection due to HELO ($sender_helo_name) not being a FQDN (contains no dot) (See RFC2821 4.1.1.1)
!hosts = 127.0.0.1
condition = ${if match{$sender_helo_name}{localhost}{no}{yes}}
condition = ${if match{$sender_helo_name}{\N^\[\N}{no}{yes}}
condition = ${if match{$sender_helo_name}{\N\.\N}{no}{yes}}
warn message = X-Invalid-HELO: HELO is not a FQDN (ends in dot) (See RFC2821 4.1.1.1)
log_message = HELO ($sender_helo_name) is not a FQDN (ends in dot) (See RFC2821 4.1.1.1)
condition = ${if match{$sender_helo_name}{\N\.$\N}}
warn message = X-Invalid-HELO: HELO is not a FQDN (contains double dot) (See RFC2821 4.1.1.1)
log_message = HELO ($sender_helo_name) is not a FQDN (contains double dot) (See RFC2821 4.1.1.1)
condition = ${if match{$sender_helo_name}{\N\.\.\N}}
deny message = Your IP address ($sender_host_address) reverse DNS looks very much like a dynamic dialup/adsl pool. Either your \
mail system is very badly set up or your machine is part of a botnet. Either way I can't accept mail from \
you. Sorry. If you believe this is incorrect please email support@xxx.yyy for assistance.
log_message = Deny connection from $sender_host_address (rDNS is $sender_host_name) which looks like dynamic IP pool (rule 1)
!hosts = +relay_from_hosts
!authenticated = *
condition = ${if match{$sender_host_name}{[0-9][0-9][0-9]?[-\.][0-9][0-9][0-9]?[-\.][0-9][0-9][0-9]?\.[a-z]\{3,\}\.}{yes}{no}}
deny message = Your IP address ($sender_host_address) reverse DNS looks very much like a dynamic dialup/adsl pool. Either your \
mail system is very badly set up or your machine is part of a botnet. Either way I can’t accept mail from \
you. Sorry. If you believe this is incorrect please email support@xxx.yyy for assistance.
log_message = Deny connection from $sender_host_address (rDNS is $sender_host_name) which looks like dynamic IP pool (rule 2)
!hosts = +relay_from_hosts
!authenticated = *
condition = ${if match{$sender_host_name}{(?:[0-9]\{1,3\}[-\.])\{2\}([0-9]\{1,6\})\{1,2\}[-\.]}{yes}{no}}
deny message = Your IP address ($sender_host_address) is listed in SBL-XBL because of spam or exploits being sent from this address. \
We cannot accept mail from this host. Please see http://www.spamhaus.org/query/bl?ip=$sender_host_address \
for more information.
log_message = Deny connection from $sender_host_address which is in SBL/XBL
dnslists = sbl-xbl.spamhaus.org
Just try getting anything through that lot! Please submit any revisions you make to these rules, share the wealth!
UPDATE:
Having installed the above rules on one of our servers, I’ve been comparing the logs throughout the day with another server (in the same load-balanced cluster), that doesn’t have the rules installed. It seems that simple ACL based spam filtering such as this can (and has) reduced the amount of spam being processed by a factor of 10 (i.e. there is 90% less mail hitting spamassassin that there was previously). For sites processing lots of mail, something as simple as this can make a huge difference (think 1 server required rather than 10).