Need help blocking spam with Postfix

December 21, 2014 9:10 AM

I've been getting increasing amounts of spam through my Postfix server, and I'm not clear on why my header_checks isn't able to block it. Any ideas?

My "[e-mail]" address is getting a lot of spam that arrives with a From: line in this form:
from=[{$something}-zonker=example.com@{$somedomanin}.com]

(Those curly brackets are actually angle brackets, but I had to change them so it would post correctly.) So I thought I'd be able to block it with a header_checks entry along the lines of:

/^From:.*zonker=example\.com/ REJECT spam

But it doesn't work. Other header_checks entries work, so the overall config should be ok, but no joy on this one. What am I doing wrong?

posted by Zonker to Computers & Internet (1 answer total)

So to be clear, a possible spam address would be something like: foobar-zonker=[e-mail] ?

If so, why not make sure the regex matches that whole line, e.g.:

/^From:.*?zonker=example\.com\@.+/ REJECT spam

(I'm forgetting off the top of my head whether @ needs to be escaped, since it often does in Perl, but that would depend on whether your postfix is setup with pcre or with posix regular expressions so try it with @ escaped and try it without)...

My postfix-fu is pretty rusty but there's gotta be a way to debug this with logging.
posted by dis_integration at 2:35 PM on December 21, 2014