Exim want to block incoming mail when senders = recipients

[djmaarten]

want to delete message below since its in the wrong discussion. I am not suc6full. sorry about this.
---------------------------------------------
Hi,

Are you also getting these emails from yourself that your devices have been monitored for months and they now want bitcoins? ) Haha.
They are driving me nuts since I get 20 of them every day in my mailbox.

I think there is a simple rule to implement inside the acl_check_recipients to block this situation on exim:
................
local_parts = ^[.] : ^.*[@%!|]
#added below
deny senders = recipients
message = 555 denied. 5.7.1 BLOCKED_DUE_TO_SPAM_SENDER
#continue exim.conf below

# If you've hit the limit, you can't send anymore. Requires exim.pl 17+
..............................

But somehow this does not work! And I can't figure out why! It never hits this line.

And there is something else strange in the current exim config.

When I am testing this on my machine:

#telnet ipmyserver 25
220 <domain> ESMTP Exim 4.94 Sat, 02 Sep 2023 13:59:15 +0200
HELO <somedomain>
250 <domain> Hello <somedomain with ip>
Mail from:<my emailaccount@domain>
250 OK
rcpt to:<my emailaccount@domain>
550 Email blocked by zen.spamhaus.org

??
This is weird since the ip and domain are not listed at spamhaus when checking those.

And, another question, when this situation (senders=recipients) is blocked by the config, how are the bitcoins guys are getting through this filter??

Does anyone know the solution to this puzzle?

Regards
Maarten

 

[Richard G]

And I can't figure out why! It never hits this line.

Seems this is some old solution, might still work. But so much in change in exim.conf that it could just already be the order of operations which makes it the mail comes through even before it hits this ACL. We had this with some default setting before too early this year and they changed it so the order was correct.

So this can be the reason the RBL's are checked before the local mail is.

Then the non presence of ip or domain on Spamhaus. Did you check a general site or did you check both on the https://check.spamhaus.org itself?