Spamassassin Blacklist Rules

Thomas
Thomas used Ask the Experts™
on
Hi,
I try to do a bit more advanced rules in the email blacklist in Spamassassin but I cant find a list of all possible rules.
Do any of you know of any comprehensible list of all wildcard characters that are allowed.

For example can I do the following

*@domainnotices*.*
*@domainnotices???.*
*@domain###notices*.*
etc.

what is possible here is there any list of possible combinations to filter there domains with constant changing numbers or 1 letter differences.

the email comes from number@domainnotices####.com or net etc.

Thank you for any assistance on this.

Best wishes,
thomas
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Niel MaraisTechnical Operations Manager

Commented:
Hi Thomas,

As far as I know the only 2 wildcards you can use are * and ?

Furthermore, it would not be possible to do what you are trying to do. Here is a brief explanation by SpamAssassin:

You can use multiple blacklist_from directives or multiple addresses in a single directive to blacklist several addresses. You can also use an asterisk (*) as a wildcard for zero or more characters and a question mark (?) as a wildcard for zero or one character, much as you would to specify filename patterns in a shell. For example, you could blacklist all mail from public.com and from all hosts in the example.com domain with these lines:
blacklist_from *@public.com
blacklist_from example.com *.example.com

Is this for the "Domain Service Notification" SPAM message? Is there perhaps something in the subject of these emails which is always the same in each message?

If so, you can use the WhiteListSubject plugin to add this common phrase or word to the blacklist: https://wiki.apache.org/spamassassin/WhiteListSubjectPlugin

-N
ThomasPartner

Author

Commented:
Hi,

Thanks for the response, I did read this entry in the SpamAssassin manual.
However I wondered if it works within the domainname and could not find anything.

Lets say I have a spamer that used something like

something@name123.com
something@name124.com
something@name125.net
something@name130.org
something@name230.com
etc.

So I guess the * should work on this
*@name*.*

would this be a legit block?

Also there is no real explanation on the usage of ?
so I assume ? would stand for any character in this particular space. Would you agree this is correct?

These people change the text all the time and to cover everything would slow down the processing time for each email and server load so the block in spamassassin seems to be the least server load?

Best wishes,
Thomas

Best wishes,
Thomas
Technical Operations Manager
Commented:
I've never tried to use as many wildcards in one rule on SpamAssassin, so I cannot say for sure if it will work but from previous experience on other platforms I fear not. One can normally only use a single wildcard.

As for the difference between "?" and "*":
The "*" wildcard is a replacement for zero or more characters
The "?" wildcard is a rplacement for zero or one character only

Have you tested your method? I'd be interested to hear if it works. Could you paste the header of an example of dodgy mail? There might be something in there you could use.

-N
Ensure you’re charging the right price for your IT

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

ThomasPartner

Author

Commented:
Hi Neil,

Thank you for your input.
it seems that it is working with * anywhere I want, just have to be real careful using to many * because it also opens for false positive. But it seems to work for my case.

Thank you for the discussion.

Best wishes,
Thom
Niel MaraisTechnical Operations Manager

Commented:
Great, now I know as well! I'm glad you could get to a solution.

-N
ThomasPartner

Author

Commented:
thanks for the assist

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial