No emails through spam-friendly host

Do you have email addresses on hosts which do not enforce any UBE/UCE filtering such as RBL/RSS/DUL? Do you want to check that your email did not visit any spam-friendly host?

Features

• Checks all Received: lines
• Does not check DUL for first hop (or more than 2 hops backwards)
• Different filters for RBL/RSS/DUL and ORBS

Requirements

• Perl. Does not use any advanced features so should work on version 4 also, but not tested. Works on perl5 (5.0 patchlevel 4 subversion 4)
• Procmail to do filtering. Do not ask me about procmail, check the Procmail FAQ.
• formail, part of procmail package

How to use

You need to set up your .procmailrc and have procmail to be run on each incoming messages, see Procmail FAQ for details. I have a small and stupid script to do it partly automaticly.

Example

Relevant parts of my .procmailrc looks like below:

MAILDIR=$HOME/Mail/spool
JUNKDIR=$HOME/Mail/junkspool
YEARMON=`date +%Y-%m`
LOGFILE=$HOME/Mail/procmail.$YEARMON
LOGABSTRACT=yes
SHELL=/bin/sh

:0
* !? $HOME/bin/chk_mail-abuse
{
  :0 fhbw
  | formail -A "X-UBE: RBL/RSS/DUL" 

  :0:
  $JUNKDIR/rss.spool
}

:0
* !? $HOME/bin/chk_orbs
{
  :0 fhbw
  | formail -A "X-UBE: ORBS" 

  :0:
  $JUNKDIR/orbs.spool
}

At first some parameters are set up, such as logging. Then each message is check for RBL/RSS/DUL lists. If there is a match, then extra X-UBE: header is included in message. Then a message is stored to proper folder. This is partly redundant as if we just want to store possible spam to different folder, we do not have to add additional header. In that case the rule is something like:

:0:
* !? $HOME/bin/chk_mail-abuse
$JUNKDIR/rss.spool

If we just want to mark spam (for example our mail program does not support multible inboxes), we remove last part of rule like:

:0
* !? $HOME/bin/chk_mail-abuse
{
  :0 fhbw
  | formail -A "X-UBE: RBL/RSS/DUL" 
}

Note that those rules assume that you have saved the suplied scripts to bin directory under your home directory. If they are in different location, change path accordingly. Remember to set up executable bit, on most systems with command chmod +x chk_mail-abuse chk_orbs

Why not check RBL/RSS/DUL and ORBS at same time

Based on my experience, the ORBS gives way too many false positives. I think I have quite good system that most of spam is cleaned up by RBL/RSS/DUL and ORBS collects rests.

Download

• chk_mail-abuse (1.1K)
• chk_orbs (631 )
• nospam (631 )

Statistics

Following figures are statistics from duration of week. Only few spams (about five) get into my not-for-me or not-known-sender folder.

Note that this comparision is not fair, as RBL/RSS/DUL traps most of spams and ORBS only the leftovers, so maybe it should be 40/7 for ORBS.

Warranty and Feedback

The package is provided as-is without warranty for any use provided that copyright information of original author is maintained. If you like, dislike or improve package, let me know.