filip/Stalwart
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Spam filter adjustements

Browse Source
This commit is contained in:
mdecimus
2023-10-23 17:19:16 +02:00
parent eae3457f77
commit 73ccf7be65
13 changed files with 115 additions and 65 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
resources/config/smtp/sieve.toml
View File

@@ -14,7 +14,7 @@ sign = ["rsa"]
redirects = 3
out-messages = 5
received-headers = 50
cpu = 50000
cpu = 1048576
nested-includes = 5
duplicate-expiry = "7d"

28
resources/config/spamfilter/maps/scores.map
View File

@@ -188,7 +188,7 @@ MULTIPLE_FROM 8.0
MULTIPLE_UNIQUE_HEADERS 7.0
MV_CASE 0.5
MW_SURBL_MULTI 7.5
OMOGRAPH_URL 5.0
HOMOGRAPH_URL 5.0
ONCE_RECEIVED 0.1
PHISHED_OPENPHISH 7.0
PHISHED_PHISHTANK 7.0
@@ -277,23 +277,23 @@ RWL_MAILSPIKE_NEUTRAL 0.0
RWL_MAILSPIKE_POSSIBLE 0.0
RWL_MAILSPIKE_VERYGOOD -0.2
R_BAD_CTE_7BIT 3.5
R_DKIM_ALLOW -0.2
R_DKIM_NA 0.0
R_DKIM_PERMFAIL 0.0
R_DKIM_REJECT 1.0
R_DKIM_TEMPFAIL 0.0
DKIM_ALLOW -0.2
DKIM_NA 0.0
DKIM_PERMFAIL 0.0
DKIM_REJECT 1.0
DKIM_TEMPFAIL 0.0
R_MISSING_CHARSET 0.5
R_MIXED_CHARSET 5.0
R_MIXED_CHARSET_URL 7.0
MIXED_CHARSET_URL 7.0
R_NO_SPACE_IN_FROM 1.0
R_PARTS_DIFFER 1.0
R_SPF_ALLOW -0.2
R_SPF_DNSFAIL 0.0
R_SPF_FAIL 1.0
R_SPF_NA 0.0
R_SPF_NEUTRAL 0.0
R_SPF_PERMFAIL 0.0
R_SPF_SOFTFAIL 0.0
SPF_ALLOW -0.2
SPF_DNSFAIL 0.0
SPF_FAIL 1.0
SPF_NA 0.0
SPF_NEUTRAL 0.0
SPF_PERMFAIL 0.0
SPF_SOFTFAIL 0.0
R_SUSPICIOUS_URL 5.0
R_UNDISC_RCPT 3.0
SEM_URIBL 3.5

12
resources/config/spamfilter/scripts/composites.sieve
View File

@@ -6,15 +6,15 @@ if eval "t.FORGED_SENDER && t.MAILLIST" {
let "t.FORGED_SENDER_MAILLIST" "1";
}
if eval "t.DMARC_POLICY_ALLOW && (t.R_SPF_SOFTFAIL || t.R_SPF_FAIL || t.R_DKIM_REJECT)" {
if eval "t.DMARC_POLICY_ALLOW && (t.SPF_SOFTFAIL || t.SPF_FAIL || t.DKIM_REJECT)" {
let "t.DMARC_POLICY_ALLOW_WITH_FAILURES" "1";
}
if eval "t.R_DKIM_NA && t.R_SPF_NA && t.DMARC_NA && t.ARC_NA" {
if eval "t.DKIM_NA && t.SPF_NA && t.DMARC_NA && t.ARC_NA" {
let "t.AUTH_NA" "1";
}
if eval "!(t.R_DKIM_NA && t.R_SPF_NA && t.DMARC_NA && t.ARC_NA) && (t.R_DKIM_NA || t.R_DKIM_TEMPFAIL || t.R_DKIM_PERMFAIL) && (t.R_SPF_NA || t.R_SPF_DNSFAIL) && t.DMARC_NA && (t.ARC_NA || t.ARC_DNSFAIL)" {
if eval "!(t.DKIM_NA && t.SPF_NA && t.DMARC_NA && t.ARC_NA) && (t.DKIM_NA || t.DKIM_TEMPFAIL || t.DKIM_PERMFAIL) && (t.SPF_NA || t.SPF_DNSFAIL) && t.DMARC_NA && (t.ARC_NA || t.ARC_DNSFAIL)" {
let "t.AUTH_NA_OR_FAIL" "1";
}
@@ -38,11 +38,11 @@ if eval "t.RECEIVED_SPAMHAUS_PBL && !t.RCVD_VIA_SMTP_AUTH" {
let "t.RCVD_UNAUTH_PBL" "1";
}
if eval "(t.R_DKIM_ALLOW || t.ARC_ALLOW) && t.RCVD_IN_DNSWL_MED" {
if eval "(t.DKIM_ALLOW || t.ARC_ALLOW) && t.RCVD_IN_DNSWL_MED" {
let "t.RCVD_DKIM_ARC_DNSWL_MED" "1";
}
if eval "(t.R_DKIM_ALLOW || t.ARC_ALLOW) && t.RCVD_IN_DNSWL_HI" {
if eval "(t.DKIM_ALLOW || t.ARC_ALLOW) && t.RCVD_IN_DNSWL_HI" {
let "t.RCVD_DKIM_ARC_DNSWL_HI" "1";
}
@@ -58,7 +58,7 @@ if eval "t.HAS_GUC_PROXY_URI || t.URIBL_RED || t.DBL_ABUSE_REDIR || t.HAS_ONION_
let "t.HAS_ANON_DOMAIN" "1";
}
if eval "(t.R_SPF_FAIL || t.R_SPF_SOFTFAIL) && (t.RCVD_COUNT_ZERO || t.RCVD_NO_TLS_LAST)" {
if eval "(t.SPF_FAIL || t.SPF_SOFTFAIL) && (t.RCVD_COUNT_ZERO || t.RCVD_NO_TLS_LAST)" {
let "t.VIOLATED_DIRECT_SPF" "1";
}

34
resources/config/spamfilter/scripts/dmarc.sieve
View File

@@ -1,29 +1,29 @@
if eval "env.spf.result == 'pass'" {
let "t.R_SPF_ALLOW" "1";
let "t.SPF_ALLOW" "1";
} elsif eval "env.spf.result == 'fail'" {
let "t.R_SPF_FAIL" "1";
let "t.SPF_FAIL" "1";
} elsif eval "env.spf.result == 'softfail'" {
let "t.R_SPF_SOFTFAIL" "1";
let "t.SPF_SOFTFAIL" "1";
} elsif eval "env.spf.result == 'neutral'" {
let "t.R_SPF_NEUTRAL" "1";
let "t.SPF_NEUTRAL" "1";
} elsif eval "env.spf.result == 'temperror'" {
let "t.R_SPF_DNSFAIL" "1";
let "t.SPF_DNSFAIL" "1";
} elsif eval "env.spf.result == 'permerror'" {
let "t.R_SPF_PERMFAIL" "1";
let "t.SPF_PERMFAIL" "1";
} else {
let "t.R_SPF_NA" "1";
let "t.SPF_NA" "1";
}
if eval "env.dkim.result == 'pass'" {
let "t.R_DKIM_ALLOW" "1";
let "t.DKIM_ALLOW" "1";
} elsif eval "env.dkim.result == 'fail'" {
let "t.R_DKIM_REJECT" "1";
let "t.DKIM_REJECT" "1";
} elsif eval "env.dkim.result == 'temperror'" {
let "t.R_DKIM_TEMPFAIL" "1";
let "t.DKIM_TEMPFAIL" "1";
} elsif eval "env.dkim.result == 'permerror'" {
let "t.R_DKIM_PERMFAIL" "1";
let "t.DKIM_PERMFAIL" "1";
} else {
let "t.R_DKIM_NA" "1";
let "t.DKIM_NA" "1";
}
if eval "env.arc.result == 'pass'" {
@@ -73,19 +73,19 @@ if eval "lookup('spam/dmarc-allow', from_domain)" {
} elsif eval "lookup('spam/spf-dkim-allow', from_domain)" {
let "is_dkim_pass" "contains(env.dkim.domains, from_domain) || t.ARC_ALLOW";
if eval "is_dkim_pass && t.R_SPF_ALLOW" {
if eval "is_dkim_pass && t.SPF_ALLOW" {
let "t.ALLOWLIST_SPF_DKIM" "1";
} elsif eval "is_dkim_pass" {
let "t.ALLOWLIST_DKIM" "1";
if eval "!t.R_SPF_DNSFAIL" {
if eval "!t.SPF_DNSFAIL" {
let "t.BLOCKLIST_SPF" "1";
}
} elsif eval "t.R_SPF_ALLOW" {
} elsif eval "t.SPF_ALLOW" {
let "t.ALLOWLIST_SPF" "1";
if eval "!t.R_DKIM_TEMPFAIL" {
if eval "!t.DKIM_TEMPFAIL" {
let "t.BLOCKLIST_DKIM" "1";
}
} elsif eval "!t.R_SPF_DNSFAIL && !t.R_DKIM_TEMPFAIL" {
} elsif eval "!t.SPF_DNSFAIL && !t.DKIM_TEMPFAIL" {
let "t.BLOCKLIST_SPF_DKIM" "1";
}
}

4
resources/config/spamfilter/scripts/ip.sieve
View File

@@ -1,8 +1,8 @@
# Reverse ip checks
if eval "env.iprev.result != ''" {
if eval "ends_with(env.iprev.result, 'error')" {
if eval "env.iprev.result == 'temperror'" {
let "t.RDNS_DNSFAIL" "1";
} elsif eval "env.iprev.result == 'fail'" {
} elsif eval "env.iprev.result == 'fail' || env.iprev.result == 'permerror'" {
let "t.RDNS_NONE" "1";
}
}

4
resources/config/spamfilter/scripts/url.sieve
View File

@@ -69,11 +69,11 @@ while "i > 0" {
if eval "!is_ascii(host)" {
let "host_cured" "cure_text(host)";
if eval "host_lc != host_cured && dns_exists(host_cured, 'ip')" {
let "t.OMOGRAPH_URL" "1";
let "t.HOMOGRAPH_URL" "1";
}
if eval "!is_single_script(host)" {
let "t.R_MIXED_CHARSET_URL" "1";
let "t.MIXED_CHARSET_URL" "1";
}
} else {
if eval "ends_with(host, 'googleusercontent.com') && starts_with(query, '/proxy/')" {