[SOLVED] Global Blacklist Not Working

[utkonos]

I have added one email address to the global blacklist, but even after a reboot, mail sent to that email address is being accepted and placed in quarantine (it is spam and getting flagged as such).

Is there something that needs to be done to use global blacklist beyond the following:

Mail Filter > Who Objects > Blacklist > Add > E-Mail:
E-Mail: deademail@example.com

This is the highest priority rule:



Log entries from pmg-smtp-filter are the following:

SA score=5/5 time=0.919 bayes=undefined autolearn=no autolearn_force=no hits=DKIM_SIGNED(0.1),DKIM_VALID(-0.1),DKIM_VALID_AU(-0.1),DKIM_VALID_EF(-0.1),HTML_MESSAGE(0.001),MISSING_DATE(1.396),RAZOR2_CF_RANGE_51_100(2.43),RAZOR2_CHECK(1.729),RCVD_IN_DNSWL_NONE(-0.0001),SPF_HELO_NONE(0.001),SPF_PASS(-0.001),URIBL_BLOCKED(0.001)
moved mail for <deademail@example.com> to spam quarantine (rule: Quarantine/Mark Spam (Level 3))
processing time: 0.974 seconds (0.919, 0.036, 0)

 

[kalachev_89]

Hi.
In e-mail rule i see to block from sender.
But in logs the deademail@example.com is recipient.
In you sutuation rule must looks like

 

[utkonos]

Thanks so much. I think that's exactly the problem. I have put that email address into a new Who Object and added that Who Object to the Blacklist rule as a "To". Hopefully I'm not doing it wrong.



The documentation is not clear on how "To" and "From" interact when they are in the same rule. Are they AND or OR together? The documentation says the following:

"These types of objects can be used for the TO and/or FROM category, and match the sender or recipient of the email."

This sentence is ambiguous as to whether these objects are ANDed together or ORed together.

 

[utkonos]

It turns out that "To" and "From" in a single rule are joined together with "AND" rather than "OR" (or there is something else going on, but either way, putting them both in one results in a condition where the rule is ignored or at least the resulting condition is not able to be met in the way I would expect.

The correct way to block is to have a single rule with a "Block" action object and a "To" who object. This results in the addresses on the "To" list being blocked as expected.



I made an Inbound Blacklist separate from the builtin Blacklist because its used differently and the addresses are internal not external.

The above works.