Per using address blocking for nuisance email

[kevindods]

I have looked through the standard spam filtering, blacklisting stuff but none quite do what I want.

Is there a way to block a particular sender (by address) of sending to a particular user on Zimbra? The idea is to be able to reject a message from a sender with an error reply but only if they send to a particular account or user.

The idea is a bit like blocking an incoming call from a telesales company ;-) I dont want to block all contact from the sender or their domain, just allow a single user to block 'nuisance' emails. I thought a filter might do that but nothing permits a reply or rejection only a simple drop/delete. Needs a reply to ensure the sender knows they are not getting through!

Any creative ideas on how? It falls in an unusual spam space!

[mmorse]

You basically want Bug 18288 - Enable a "reply with text" (or auto-reply) option for Mail Filters + discard.

The notice aspect is a rock in a hard place, but here's some options (both with and without a reply).

Option 1: (postfix header checks with notice)

header_checks = pcre:/opt/zimbra/conf/postfix_header_checks

Something like:

if
/^From: someone@external.com/
/^To: user@domain.com/ REJECT Sorry, but your message was refused. If legitimate, please contact the user through other means.
Test with WARN and then grep your logs. Whatever message is to the right of REJECT will be sent to the sending server/user, you can also specify smtp error codes, default is like 5.5.4 or .7 I believe.

endif

Option 2: (amavisd hard lists - would rather not notice msg on this one)

I'd seriously avoid this option of messing with the behavior for all your spam messages but if you have to....You could do the below combined with final_spam_destiny D_BOUNCE (or less verbose D_REJECT) rather than the preferred D_DISCARD which typically won't notify sender of success or failure, effectively dropping the mail (but you can choose to quarantine still). If you still really want to do this, might play with your sa_dsn_cutoff_level value so your not sending 'here I am' bounces to bad spammers.

The below is really much better if you can ignore the 'needs notice' requirement.

zmprov ma user@domain.com +amavisBlacklistSender name1@example.com +amavisBlacklistSender name2@example2.com

Soap is GetWhiteBlackListRequest & ModifyWhiteBlackListRequest.

(With default behaviors all you'll get about such a message is just "discarded, SPAM, sender blacklisted" in the zimbra.log.)

In GnR it's also in preferences:


(Controlled by zimbraMailBlacklistMaxNumEntries on the cos/account.)

Option 3: (content filters)

Research all the other content filter software out there

Postfix even has some handling:
Postfix before-queue Milter support
Postfix After-Queue Content Filter

Option 4: (spamassassin - no notice msg, but file to junk)

Give them a specific rule in spamassassin. Be sure to include both To and From in this rule, else you'll effect other legit mail.
Something like:

header __TO_USERNAME    To =~ /^user@domain\.com/
header __FROM_UNWANTED    From =~ /^whoever@yourdomain\.com/i
meta USERNAME_BLACKLIST    (__TO_USERNAME && __FROM_UNWANTED)
score USERNAME_BLACKLIST 1.1 1.2 1.3 1.4
describe USERNAME_BLACKLIST Personal soft blacklist.

-Thus it would land in the junk folder (tagged) or if really high be removed (killed).
-Expand it with boolean operands like && and, || or, ! nor as well as xor, xnor values as well.
-Obviously I didn't test the above with spamassasin --lint so careful before taking that rule live in /opt/zimbra/conf/spamassassin 20_head_test.cf or local.cf

Option 5: (Amavisd again, but this time to junk. No notice unless you go over the kill limit but not over the sa_dsn_cutoff_level, and also adjust the final_spam_destiny - again I'd avoid setting that part globally.)
Checkout your /opt/zimbra/conf/amavis.conf.in file, you should see a section like:

# ENVELOPE SENDER SOFT-WHITELISTING / SOFT-BLACKLISTING
@score_sender_maps = ({ # a by-recipient hash lookup table,
# results from all matching recipient tables are summed

# ## per-recipient personal tables (NOTE: positive: black, negative: white)
# 'user1@example.com' => [{'blah@bad.com' => 10.0}],
# 'user3@example.com' => [{'.good.com' => -3.0}],
# '.angel.com' => -5.0}],

Add more 'user@domain.com' => [{'unwanted@external.com' => 10.0}], and adjust scores accordingly.

[kevindods]

Thanks Mike, there looks like several with mileage there - appreciate the pointers. Would be good to have this handled by the user in a webUI, well in some cases it would! ;-)

I will look and consider voting on the feature request too. I have had nightmares like many with users setting auto-responders, loops and the like, especially to lists and the annoyances they create but to paraphrase - auto-responders don't kill mail systems, users do ;-)

K