Who Objects -> Blacklist-> Domain (Not Working)

[hata_ph]

Is there a way to avoid having both a regular expression for
Type Reg-Exp: *\.domain\.com ( handles sub-domains )
and
Type Domain: domain.com ( handles the domain itself )

Just thinking a single rule is more efficient...

Thanks

Try the regex i mentioned above

 

[MiamiJack]

I did, it didn't match the domain only so bob@domain.com passed, but bob@xyz.domain.com failed.
I'll try it again just to double check and report back.

OK, it worked, I will test for a couple of others, I need to remove the previous rules and give it another shot.
Thanks

 

[hata_ph]

I did, it didn't match the domain only so bob@domain.com passed, but bob@xyz.domain.com failed.
I'll try it again just to double check and report back.

I checked both seem working in the test string. I have updated the regex, pls double check again

(\W|^)[\w.+\-]{0,50}@[\w.+\-]{0,50}domain\.com(\W|$)

 

[MiamiJack]

That works, I removed all rules, recreated from scratch to insure no conflicts or residual information/rules.
Works perfect.
Thanks!!

 

[MiamiJack]

Hello Again,

With my tests forcing the sender info I was able to block e-mail, but much to my surprise today another snuck through.
I do see the sender information containing the domain we are looking for in the regular expression.

Any suggestions?

 

[MiamiJack]

Additional issue with regular expressions.
This worked 100% I literally sent 30 messages testing this from one of my servers to see the blocks work.
You can see the block information from my tests.

Today after the spam I went to double check some things and when I edited the regular expression under no circumstances does the expression work.

To show that I'm not totally nuts I will attach a small video. ( well I may still be nuts considering I'm in IT )
Video 1 -> https://screenrec.com/share/cWyQD7lKpZ
Video 2 -> https://screenrec.com/share/8elqWFUrTf

I understand what we are doing here, am familiar with regex from perl, and I'm either missing something or something isn't working correctly.

For reference I sent another test from one of my servers with the from containing one of those domains we are testing for and it did block, so the regular expression I'm referencing here (#26) is more about the web gui test of the regex.

This is separate from (#25)

 

[hata_ph]

Hello Again,

With my tests forcing the sender info I was able to block e-mail, but much to my surprise today another snuck through.
I do see the sender information containing the domain we are looking for in the regular expression.

Any suggestions?

Show the mail log for that incoming mail. You can get it under Tracking center.

You choose From or To for your blacklist who object in your filter rules?

 

[hata_ph]

Additional issue with regular expressions.
This worked 100% I literally sent 30 messages testing this from one of my servers to see the blocks work.
You can see the block information from my tests.

Today after the spam I went to double check some things and when I edited the regular expression under no circumstances does the expression work.

To show that I'm not totally nuts I will attach a small video. ( well I may still be nuts considering I'm in IT )
Video 1 -> https://screenrec.com/share/cWyQD7lKpZ
Video 2 -> https://screenrec.com/share/8elqWFUrTf

I understand what we are doing here, am familiar with regex from perl, and I'm either missing something or something isn't working correctly.

For reference I sent another test from one of my servers with the from containing one of those domains we are testing for and it did block, so the regular expression I'm referencing here (#26) is more about the web gui test of the regex.

This is separate from (#25)

Save your regex pattern then test string again. I remember it happen before on me. Some time a restart do help.

 

[MiamiJack]

@hata_ph FIRST thanks for taking the time to help me!

Amazingly the messgage does not show up in tracking center.
I do see it here in maillog:
Oct 6 11:19:32 mgw pmg-smtp-filter[22699]: 813695F7C8B04AC9EF: new mail message-id=<2aD-5545610baa-F@embluemail.com>#012
Oct 6 11:19:33 mgw pmg-smtp-filter[22699]: 813695F7C8B04AC9EF: SA score=1/5 time=1.023 bayes=undefined autolearn=no autolearn_force=no hits=AWL(-0.815),DKIM_SIGNED(0.1),DKIM_VALID(-0.1),DKIM_VALID_AU(-0.1),HEADER_FROM_DIFFERENT_DOMAINS(0.249),HTML_MESSAGE(0.001),SPF_HELO_NONE(0.001),SPF_PASS(-0.001),T_REMOTE_IMAGE(0.01),URIBL_BLACK(1.7)
Oct 6 11:19:33 mgw pmg-smtp-filter[22699]: 813695F7C8B04AC9EF: accept mail to <accounting@test-domain.com> (CA5A1814E2) (rule: default-accept)
Oct 6 11:19:33 mgw pmg-smtp-filter[22699]: 813695F7C8B04AC9EF: processing time: 1.175 seconds (1.023, 0.063, 0)
Oct 6 11:19:33 mgw postfix/lmtp[22765]: 2F7D38002D: to=<accounting@test-domain.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=5.2, delays=4/0/0.01/1.2, dsn=2.5.0, status=sent (250 2.5.0 OK (813695F7C8B04AC9EF))

* on a side note, the only blocked domain emails from all of our blacklist configuration and such are the ones we sent for testing...
I also added bluejet and bluemail to the who regex


Adding another email here in the headers.txt file, I can clearly see the sender, but tracking center won't matching anything in the header.

 

[hata_ph]

1. Show all your blacklist content and your mail filter.
2. Search by recipient email or filter in Tracking Center to show the details.

 

[MiamiJack]

Hello,

I found the email in the tracking center, the email has no FROM according to tracking center and it showed up when I selected with empty sender.
The message does however have a from when you receive it.
I know in postfix we have some options for blocking empty sender, but I believe it was frowned upon.

 

[hata_ph]

Try this under what object

 

[MiamiJack]

I will try that, thank you.

On a side note, here is another where the from shows as empty sender in Tracking center.
Header and tracking attached.

 

[hata_ph]

It is by design to accept empty mail from. But there are way to filter/quarantine such behavior using PMG's mail filter or postfix's check_sender_access/header_check.

https://serverfault.com/questions/151955/why-an-empty-mail-from-address-can-sent-out-email
http://postfix.1071664.n5.nabble.co...-address-for-authenticated-users-td83425.html
https://www.linuxbabe.com/mail-server/block-email-spam-check-header-body-with-postfix-spamassassin

 

[MiamiJack]

Not having success with the additional who/what references.

Several similar to this got through:
subject: SPAM: Do This Immediately To Remove Nail Fungus (Try It)
From: "Fungus Eliminator" <BKQ5HYR1.BKQ5HYR1@96S9.brimmats.com>
To: alic@wber556.net
Content-Type: text/html; charset=utf-8;


We have who - blacklist reg-ex
(\W|^)[\w.+\-]{0,50}@[\w.+\-]{0,50}brimmats\.com(\W|$)

We have What - Match fields from
(\W|^)[\w.+\-]{0,50}@[\w.+\-]{0,50}brimmats\.com(\W|$)

Any suggestions?

They are actually hitting several email accounts from that sender domain.

Thanks!

 

[hata_ph]

Not having success with the additional who/what references.

Several similar to this got through:
subject: SPAM: Do This Immediately To Remove Nail Fungus (Try It)
From: "Fungus Eliminator" <BKQ5HYR1.BKQ5HYR1@96S9.brimmats.com>
To: alicia@web56.net
Content-Type: text/html; charset=utf-8;


We have who - blacklist reg-ex
(\W|^)[\w.+\-]{0,50}@[\w.+\-]{0,50}brimmats\.com(\W|$)

We have What - Match fields from
(\W|^)[\w.+\-]{0,50}@[\w.+\-]{0,50}brimmats\.com(\W|$)

Any suggestions?

They are actually hitting several email accounts from that sender domain.

Thanks!

Does your rules work just by using the From who object?

 

[MiamiJack]

Hello,

No, it doesn't work at all and I have it both in the who with a regex and the what with from regex

 

[hata_ph]

Pls show your full mail filter rules list

 

[MiamiJack]

Here are the rules...
Thank you again for taking the time to help!

 

[hata_ph]

@MiamiJack, disable the what object, just use who object. Show the rules too.