header content rule

[digiweb]

I want to block the incoming mail according to a word in header content. How do I add a rule for this?

 

[hata_ph]

which header content?
Try what object -> match field

 

[digiweb]

For example, I want to block the following incoming mail

Header Example:

Received: from server.spamfilter.biz ([185.42.173.108])
by legolas.linkglobe.com with esmtp (Exim 4.95)
(envelope-from <tanitim@xyzsafe.info.tr>)
id 1nTsWi-0002Yd-7y
for info@deneme.com;
Tue, 15 Mar 2022 00:46:52 +0300
Received: from mail by legolas.linkglobe.com with spam-scanned (Exim 4.95)
(envelope-from <tanitim@xyzsafe.info.tr>)
id 1nTsWi-0002Yk-8m
for info@deneme.com;
Tue, 15 Mar 2022 00:46:57 +0300
Received: from micro203.xyzsafe.info.tr (micro203.xyzsafe.info.tr [77.92.116.203])
by server.spamfilter.biz (Proxmox) with ESMTP id B2FE96C041A
for <info@deneme.com>; Tue, 15 Mar 2022 00:47:13 +0300 (+03)
Received: from server.spamfilter.biz (localhost.localdomain [127.0.0.1])
by server.spamfilter.biz (Proxmox) with ESMTP id 20B8A6C0433
for <info@deneme.com>; Tue, 15 Mar 2022 00:47:20 +0300 (+03)

 

[hata_ph]

Pls provide a more complete spam mail raw format and paste as code for easy to check the header info.

 

[digiweb]

I sent it as a .msg file

 

[hata_ph]

Cannot open the MSG file. Pls provide as .eml file.

 

[digiweb]

I sent it as a .eml file

 

[hata_ph]

Try this what object.

 

[hata_ph]

Another option is spamassassin custom rule for subject with UTF-8 encoding.
Add or create /etc/mail/spamassassin/custom.cf with below rules and run systemctl restart pmg-smtp-filter to restart the filter service.

https://pmg.proxmox.com/pmg-docs/pmg-admin-guide.html#_custom_spamassassin_configuration

# Subjects with UTF-8 encoding
header          SUBJ_UTF8       Subject:raw =~ /=?utf-8?.?/i
describe        SUBJ_UTF8       Subject with UTF-8 encoding
score           SUBJ_UTF8       1.0

# Subjects with EUC encoding
header          __EUC_CN        Subject:raw =~ /=?euc-cn?.?/i
header          __EUC_JP        Subject:raw =~ /=?euc-jp?.?/i
header          __EUC_KR        Subject:raw =~ /=?euc-kr?.?/i
header          __EUC_TW        Subject:raw =~ /=?euc-tw?.?/i
meta            SUBJ_EUC        ( __EUC_CN || __EUC_JP || __EUC_KR || __EUC_TW )
describe        SUBJ_EUC        Subjects with EUC encoding
score           SUBJ_EUC        1.0

 

[digiweb]

Is there a standard configuration you have that I can add to the spamassassin custom.conf file?

Moreover; These settings do not go away when the system receives an update, right?

 

[hata_ph]

/etc/mail/spamassassin/custom.cf will remain after restart.
Read more about creating your own spamassassin rules.

https://cwiki.apache.org/confluence/display/SPAMASSASSIN/writingrules
https://gist.github.com/jult/9bfdc4d07b44be01a02cc2aaf25b7c39
https://github.com/kawaiipantsu/spamassassin-rules

 

[digiweb]

thank's bro