Best method to block any part of the header containing a value?

[MiamiJack]

Hello All,

I'm having a hard time with getting a domain name weather its the envelope sender OR the from sender to simply block or via SA flag the message so it doesn't go through.
I have who with domain names, who with regular expression domain names, what with from rules and match field and simply hit or miss.

So my question is if I create 1 or 5 if needed policies to simply say if it says "ImAJerkSpammer.com" anywhere in the header, reject it, quarantine it something.

I do write additional Objects so I can better track what is and isn't working between Who/What/Regular Expression etc, I just need to be able to shut down the noise.

In a very slight side note one of my objects:
What->BL-What-FromRules is using Match field, field being from and I'm putting a value of .+@ImAJerkSpammer.com as the value, now the test string likes the regex, but i'm seeing messages for those domains still coming through and yes many of these are working, just not all.

Thank you!!!

Sample of Rules Execution showing count of each that worked:
    106 (rule: Block
    484 (rule: BL-What-From)
     26 (rule: BL-Who-Domains)
    604 (rule: BL-Who-DomainsR)
    317 (rule: BL-Who-IP)
   4879 (rule: BL-Who-IP-NW)

 

[Stoiko Ivanov]

So my question is if I create 1 or 5 if needed policies to simply say if it says "ImAJerkSpammer.com" anywhere in the header, reject it, quarantine it something.

without logs I'm not sure if I understand you correctly - but simple start with 2 rules:
* one with a WhoRegex object matching '.*ImAJerkSpammer.com' and action block/quarantine
* one with a What Object, Match field with field 'from' and '.*ImAJerkSpammer.com' as value and action quarantine (with a priority one lower than the first rule) - optionally add the other headers you want to match as well there in the What Object

nothing more to it

 

[MiamiJack]

Yes, I did create a script to create 2 rules for every domain I provide:
One Match Field->from->".+@ImAJerkSpammer.com"
One Match Field->reply_to->".+@ImAJerkSpammer.com"

My question above was rather than do the above to objects, to make 1 object but match any field, from, reply_to, deliver-to, return-path etc, so no matter where in the header that domain is found we would simply reject it ( i don't believe it sees the reverse of the ip as part of the header )..


Thank you!

 

[Stoiko Ivanov]

, to make 1 object but match any field, from, reply_to, deliver-to, return-path

add these as additional MatchField objects to the What group..

the return-path should be the Envelop sender you can match those with Who objects