Filter on mail server in chain

[GKrem]

i wonder if it is possible to filter a mail server in the chain?
The last one typically is my provider. But i want to filter on the first one.
Concrete - exchangelab.com and outlook.com.
Both started to send a large amount of spam after i activated my microsoft 365.

 

[Stoiko Ivanov]

In the next released version of `pmg-api` you should be able to do that (ok not on the 'first one' but on 'any of the' ) by creating a What Object that matches on Received header (Match field object)

currently only the first is matched:
https://lists.proxmox.com/pipermail/pmg-devel/2022-May/002011.html


I hope this helps!

 

[GKrem]

Hello Stoiko,
what do you mean by the first? Is it the "last" entry reading the header top - down? That would be O.K. for me.
If i could identify it like "outlook.com" i could force it to go to quarantain.
I will test it with a what rule on field "from" and regex "(?i)(\W|^)(outlook.com|exchangelabs.com)(\W|$)"

 

[Stoiko Ivanov]

what do you mean by the first? Is it the "last" entry reading the header top - down? That would be O.K. for me.

see the thread referenced in the commit-message I posted above - I think that exemplifies this quite well:
https://forum.proxmox.com/threads/filter-based-on-received-header.109629/

The patch will change the behavior though (it will match if the mail passes through an outlook MX - although I don't think that it should matter in practice)

I will test it with a what rule on field "from" and regex "(?i)(\W|^)(outlook.com|exchangelabs.com)(\W|$)"

Since you did not paste a sample mail I cannot say for sure - but ... I think you want to match on the 'Received' headers - not the 'From' headers?

I hope this helps!

 

[GKrem]

sorry Stoiko,
the example mail ist the same as in the base64 thread ;-)

 

[Stoiko Ivanov]

Ok - from the looks of the header I don't think it will currently work - the first Received header for PMG, which would be matched (if I'm not mistaken) would be:

Received: from mo.sturmlan.net [136.243.187.20]
by pmg.xxx-xx.local with POP3 (fetchmail-6.4.16)
for <guenter@xxxxxxxxxx.de> (single-drop); Tue, 14 Jun 2022 06:26:04 +0200 (CEST)

so you'll need to wait for the next pmg-api version.

 

[GKrem]

Thank you, Stoiko.
What you mean by "the first" is the last one in the chain out of my view.
To check on this will indeed not help to solve the problem.
I am looking forward to the next pmg-api version.
Any idea about the launch date?

Best wishes

G.

 

[Stoiko Ivanov]

What you mean by "the first" is the last one in the chain out of my view.

If I remember correctly from my tests back then - it was the first as it appears in the mail-source (the first one from the top) - when the mail reaches pmg-smtp-filter

I am looking forward to the next pmg-api version.
Any idea about the launch date?

Nothing that I could promise - but since quite a few small fixes have accumulated I think we'll release it to the test-repo some time soon

I hope this helps!