Mailing List Archive

At 07:52 PM 2/17/2004, Damon McMahon wrote:
>I want to be able to tag mail with certain domains in the To: header, but
>then exclude certain addresses from this filter; something like:
>
>blacklist_to *@baddomain.com
>unblacklist_to good_address@baddomain.com
>
>There does not appear to be an unblacklist_to directive. Can anyone assist?

It should be noted that blacklist_to was kind of added as an afterthought..
so it's not surprising it lacks an un* feature.

It was mostly added because all the other combinations of
(black|white)list_(from|to) existed, except that one.

You might try:
blacklist_to *@baddomain.com
whitelist_to good_address@baddomain.com

and see what wins out.

Thanks Matt, I did try that but the resultant score was too high for
mail addressed to good_address.

Perhaps I'll elaborate. We have a deprecated ISP account which I'll call
good_address@baddomain.com . I notice a lot of spam not being tagged
with too low a score going to this address, but a distinguishing feature
of much of it is that the To: header contains
some_other_address@baddomain.com . So, I want to be able to tell SA that
anything which contains To: *@baddomain.com but does not contain To:
good_address@baddomain.com is most likely spam.

What I really would like is a regex to place in a HEADER test, but I'm a
novice at regexs and can't see a way to do this. Perhaps there is?

Matt Kettler wrote:
> At 07:52 PM 2/17/2004, Damon McMahon wrote:
>
>> I want to be able to tag mail with certain domains in the To: header,
>> but then exclude certain addresses from this filter; something like:
>>
>> blacklist_to *@baddomain.com
>> unblacklist_to good_address@baddomain.com
>>
>> There does not appear to be an unblacklist_to directive. Can anyone
>> assist?
>
>
> It should be noted that blacklist_to was kind of added as an
> afterthought.. so it's not surprising it lacks an un* feature.
>
> It was mostly added because all the other combinations of
> (black|white)list_(from|to) existed, except that one.
>
> You might try:
> blacklist_to *@baddomain.com
> whitelist_to good_address@baddomain.com
>
> and see what wins out.
>
>

At 08:28 PM 2/17/2004, Damon McMahon wrote:
>Perhaps I'll elaborate. We have a deprecated ISP account which I'll call
>good_address@baddomain.com . I notice a lot of spam not being tagged with
>too low a score going to this address, but a distinguishing feature of
>much of it is that the To: header contains
>some_other_address@baddomain.com . So, I want to be able to tell SA that
>anything which contains To: *@baddomain.com but does not contain To:
>good_address@baddomain.com is most likely spam.
>
>What I really would like is a regex to place in a HEADER test, but I'm a
>novice at regexs and can't see a way to do this. Perhaps there is?

I'd do a meta test myself.. something like this:

header __FROM_BADDOMAIN From =~ /baddomain\.com/i
header __FROM_BADDOMAIN_GOOD_ADDR From =~ /good_address\@baddomain\.com/i
meta FROM_BADDOMAIN_NOT_GOOD (__FROM_BADDOMAIN &&
! __FROM_BADDOMAIN_GOOD_ADDR)

score FROM_BADDOMAIN_NOT_GOOD 20.0

Note: the above was written off the top of my head and might contain typos,
syntax errors, etc and isn't tested. But, it gets the idea across.

Thanks, Matt, that works a charm!

Matt Kettler wrote:

> At 08:28 PM 2/17/2004, Damon McMahon wrote:
>
>> Perhaps I'll elaborate. We have a deprecated ISP account which I'll
>> call good_address@baddomain.com . I notice a lot of spam not being
>> tagged with too low a score going to this address, but a
>> distinguishing feature of much of it is that the To: header contains
>> some_other_address@baddomain.com . So, I want to be able to tell SA
>> that anything which contains To: *@baddomain.com but does not contain
>> To: good_address@baddomain.com is most likely spam.
>>
>> What I really would like is a regex to place in a HEADER test, but I'm
>> a novice at regexs and can't see a way to do this. Perhaps there is?
>
>
> I'd do a meta test myself.. something like this:
>
> header __FROM_BADDOMAIN From =~ /baddomain\.com/i
> header __FROM_BADDOMAIN_GOOD_ADDR From =~
> /good_address\@baddomain\.com/i
> meta FROM_BADDOMAIN_NOT_GOOD (__FROM_BADDOMAIN && !
> __FROM_BADDOMAIN_GOOD_ADDR)
>
> score FROM_BADDOMAIN_NOT_GOOD 20.0
>
> Note: the above was written off the top of my head and might contain
> typos, syntax errors, etc and isn't tested. But, it gets the idea across.
>