global blocklist domains for e-mail

[freakie]

Hi,

i wanted to make a global blacklist in which domains are present from which we dont any e-mails.

we are using rspamd so i did this:

create the file in /etc/rspamd/local.d/blacklist.conf
contents:

reject_content {
type = "content";
filter = "full";
map = "/etc/rspamd/local.d/blacklist.map";
symbol = "REJECT_CONTENT";
score = 10.0;
prefilter = true;
regexp = true;
}


then i created the file /etc/rspamd/local.d/blacklist.map
contents:

domain1.com.
domain2.com


but this isnt working.

anyone gat an idea?

 

[Richard G]

I don't work with rspamd so I have no clue if you definately want it in rspamd.
But if you really don't want mail from domains then I use the /etc/virtual/blacklist_domains file for that, then they are already blocked at Exim before spamcheck is even done if I'm correct.
Some form of wildcard and regexp can be used in there too if done correctly.

 

[zEitEr]

we are using rspamd so i did this:

is Rspamd/SpamAssassin enabled for a user under the question?

 

[freakie]

yes, it is enabled. but i will try the suggestion of richard

 

[Rolf B]

We do this via multimap, then you can see how effective the rule is in the web interface.

/etc/rspamd/local.d/multimap.conf:

BLACKLIST_SENDER_DOMAIN {
priority = 5;
type = "from";
filter = "email:domain";
prefilter = true;
regexp = true;
map = "http://patches.xy.nl/rspamd/blacklist_sender_domain.map";
score = 20.0;
require_symbols = ["!WHITELIST_IP", "!WHITELIST_SENDER_DOMAIN", "!WHITELIST_SENDER_EMAIL"];
action = "reject";
}

 

[freakie]

Hi, thanks for the answer. the url you use doesnt resolve. can i also use a local text file for it? how does such a file look like? (syntax)

 

[freakie]

nvm, i found it. tnx for the answer

 

[Richard G]

nvm, i found it. tnx for the answer

Care to share? I'm sure others would be interested too, or in the future.

 

[freakie]

the contents of /etc/rspamd/local.d/blacklist.map

firets.nl
comaxe.cloud
pfxstormshelters.com
conuk.in.rs
allstarts.online
yagsep.site
cunjas.space
mabsge.store
cokimc.com.tr
/.*\.cyou$/

contents of /etc/rspamd/local.d/multimap.conf

BLACKLIST_SENDER_DOMAIN {
priority = 5;
type = "from";
filter = "email:domain";
prefilter = true;
regexp = true;
map = "/etc/rspamd/local.d/blacklist.map";
score = 20.0;
require_symbols = ["!WHITELIST_IP", "!WHITELIST_SENDER_DOMAIN", "!WHITELIST_SENDER_EMAIL"];
action = "reject";
}


I checkd the rspamd logs and it seems to work, it blocks the domains.

if it keeps working i will distribute these two files in my network on other DA machines.

 

[freakie]

after addings these files or chaning you should reload/restart rspamd