Mark mails from new TLD as spam with amavis/spamassassin

Discussion in 'ISPConfig 3 Priority Support' started by chico11mbit, May 2, 2018.

  1. chico11mbit

    chico11mbit Member HowtoForge Supporter

    As we all know, the new TLD's, like.host,.game,.top etc. almost only spammails. Now I want to mark these mails from these TLD's in the spamscore and lift them. Rejecting or deleting is unfortunately not an option using an ISPConfig built-in content filter (with header-regex pattern), since these mails must still be delivered.

    How can I use amavisd/spamassassin, as implemented in ISPConfig, to set the score for mails from these new TLD's so high that they get a meaningful spam score?

    With best regards
    Chico
     
  2. till

    till Super Moderator Staff Member ISPConfig Developer

    You'll probably have to create a filter for SpamAssassin or mayb someone created something like that already. ISPconfig uses the default way to configure amavis, so there is nothing special in this regard, just follow any howto that you find about SpamAssassin or amavis to create your filter and then enable it in /etc/spamassasin/local.cf and restart amavis.
     
  3. chico11mbit

    chico11mbit Member HowtoForge Supporter

    ok,
    in case somebody is searching this topic.
    I have made a file with the name 02_z_tld.cf in /etc/mail/spamassassin.
    The content of the file is
    Code:
    # add points if the From address is from a listed TLD
    header      LOCAL_FROM_TLD  From   =~ /@[a-z0-9\-\.]+\.(win|bid|xyz|cricket|review|accountant|download|loan|trade|press|online)/i
    describe    LOCAL_FROM_TLD         From address is a TLD listed in line 1
    score       LOCAL_FROM_TLD  6
    
    1 line: all TLD with the matching patterns (win, bid ... online) are penalized/blacklisted. In case you want to whitelist this line (e.g. with com|net|de ...) , set !~ where =~ is and change the matching patterns.
    line 2: is description
    line 3: Setting the final score to 6.

    restart the service amavis on your server.

    Check the matching in your email header in X-Spam-Status: ⁨... [LOCAL_FROM_TLD=6]
     
    till likes this.

Share This Page