Black list on header value?

[Glenn Steen]

On 14 September 2010 06:19, James Gray <james at gray.net.au> wrote:
>
> On 13/09/2010, at 9:41 PM, Glenn Steen wrote:
>
>> On 13 September 2010 12:52, Hugo van der Kooij <hvdkooij at vanderkooij.org> wrote:
>>>
>>> On Mon, 13 Sep 2010 19:14:04 +1000, James Gray <james at gray.net.au> wrote:
>>>> Hi All,
>>>>
>>>> I've done a bit of digging through the archives and didn't find
>>> anything,
>>>> so I'll ask anyway - but first some background.  I have an upstream
>>>> provider who uses SpamAssassin and I can't enable/disable it on a
>>> per-user
>>>> or domain basis - it's all or nothing.  Given this limitation, is there
>>> any
>>>> way I can use a black list rule to prevent MailScanner rescanning
>>> messages
>>>> already flagged as spam by the upstream??  Specifically, I want to
>>>> blacklist on the "X-Spam-Flag: YES" header.
>>>
>>> I know you can use checks like this in postfix. But my normal blacklisting
>>> entries use a REJECT policy there and you definity don't want to REJECT
>>> them as it will result in a a spam bouncer.
>>>
>>> Hugo.
>>>
>> So why not DISCARD instead? Should be safe enough:-). Unless there is
>> a margin for error, and then you need accept/handle them, in which
>> case things start to look a bit... hairy...:/
>
> Hi Glenn,
>
> Yeh, I don't trust the upstream as much as I do my own setup.  There are enough false-positives to make me wary of discarding them at the MTA level.  A MailScanner blacklist on header/subject+regex would be ideal because I can then tell MailScanner to simply not scan them and pass them over to the MTA for final delivery.  Hrm - custom function it is then :(
>
> Cheers,
>
> James
IIRC you do use Postfix, and then the Received -> HOLD thing puts a
limit on what you can do... Hugo posted a nice alternative to it,
rather longish while back, but unfortunately I don't think you can
utilize that to the effect needed... So it looks like you need do
something clever in MS. I'm just into my second cup of java, so ...
Bright ideas will follow the third or fourth:-):-)
Or Hugo will jump in and tell us that you can use his alternative
method;-)... Or Jules will write it for you:D

Cheers
-- 
-- Glenn
email: glenn < dot > steen < at > gmail < dot > com
work: glenn < dot > steen < at > ap1 < dot > se