Multiple RBL Hits and High Scoring Action

Nathan Johanson nathan at TCPNETWORKS.NET
Mon May 12 20:06:26 IST 2003


I am using MailScanner's RBL functionality (and bypassing Spam
Assassin's RBL checks). 

Would it be difficult to add a feature to MailScanner that triggers the
high scoring spam action when the sending system is found on more than
one blacklist? I figure if two or more blacklists are triggered, the
spamminess probability is high enough to warrant deletion.

I know there was some discussion about turning off RBLs in MailScanner
and using SpamAssassin to set higher scores per blacklist in order the
exceed the high score threshold. But this doesn't really work for me, as
I don't want to delete if found on any *single* blacklist, but rather
delete if found on *more than one*.

Can it be done?


Nathan Johanson
Email: nathan at

-----Original Message-----
From: Julian Field [mailto:mailscanner at ECS.SOTON.AC.UK] 
Sent: Monday, May 12, 2003 10:09 AM
Subject: Re: Spam rule wildcards...

At 17:43 12/05/2003, you wrote:
>Sendmail allows the use of the "+" character to indicate additional
data for a
>user -- without having an explicit alias set up to handle it.  So, user
>johndoe at can get mail at johndoe+spamtag at without any
>However, I just noticed that this doesn't hit the intended rule in my
>spam.action.rules file.  johndoe actually gets mail at multiple
domains, so my
>rule for him looks like this:
>To:     johndoe@*       deliver
>What is the best way to handle this?  Should I just add an additional
rule for
>johndoe like this:
>To:     johndoe+*@*     deliver
>...will that work as intended?

That should do it. However, you could give the explicit regular
in there if you want to:
To:     /^johndoe\+.*\@/        deliver
(nothing is needed after the "\@" except for the closing "/" character.
Julian Field
Professional Support Services at
MailScanner thanks transtec Computers for their support

More information about the MailScanner mailing list