How can I block this spam coming via Google?

[Ohm J]

Need ratelimitter from exim.conf, pure spamassassin can't prevent this anymore since it validate/pass rDNS, DKIM, SPF. So the spam score become -15

The one feature that DA still missing, but it's gonna has the problem with big email service like gmail or hotmail, it gonna trigger the ratelimit faster than other mail service.

 

[Richard G]

A ratelimitter won't fix this either because it's not like we are receiving them in a high rate flow, they are several a day and it's very annoying.

Google and Microsoft should just stop using this service or protect things better. Otherwise it's better to block everything coming from gmail which is not from @gmail.com address I think. I just don't know how to do that yet.
Although this would also block a lot of valid domains.

 

[mxroute]

I didn't read the whole thread, but this right here goes in /etc/exim.acl_check_recipient.pre.conf:

# Nice try fuckers
deny    message   = Envelope sender domain not permitted
        !senders  = /etc/exim/firebaseapp_whitelist
        condition = ${if match{$sender_address_domain}{\N(^|\.)firebaseapp\.com$\N}{yes}{no}}

Then you whitelist the exceptions in /etc/exim/firebaseapp_whitelist (touch the file first if you keep the whitelist).

It's hard to stay on top of all of the trends, you can see my whole exim.acl_check_recipient.pre.conf here:

Shared paste · MXroute

paste.mxroute.com

It just keeps growing and growing as trends change. With AI involved now, the chase never ends. That's why I'm working on a hybrid in-house LLM filtering model. Btw don't drop my whole exim.acl_check_recipient.pre.conf into yours, exim won't reload, it has dependencies.

 

[Richard G]

Then you whitelist the exceptions in /etc/exim/firebaseapp_whitelist (touch the file first if you keep the whitelist).

Thank you very much, but I think here is where it would go wrong for me.

I'm no scripter so often I don't really understand these things fully. But doesn't this block everything except what is in the whitelist? Or am I misunderstanding something here?

Would be very hard for me and I also would like to use whitelists to a minimum if possible. To me it's only important that only all mails from gmail.com are also originated from gmail.com and not from some other domain which is sending via gmail.com.

I loved your RBL earlier, unfortunately I had to disable it (also asked by my collegue who pays for the server), because it blocked just a bit too many good addresses.

It just keeps growing and growing as trends change.

Very big list you got there, LoL. Looks good. I think I might be able to get some more interesting out of it.

 

[mxroute]

But doesn't this block everything except what is in the whitelist

Everything from firebase addresses. Which, frankly, your whitelist is likely to remain empty. No one important sends email from a firebase hostname as the envelope sender.

 

[Richard G]

Everything from firebase addresses.

Yes, but then I don't understand how this will help me to block everythihg coming from gmail.com which is not a gmail.com address (except forwards).

 

[sysdev]

I'm from an era where you could use telnet to send mail, as anyone, to anywhere. Glorious times!
Our best defence at that time was "if it's from there and has d*ck in it, it's spam". And now we're back full circle where spammers simply make sure the hurdles we throw at them are taken and they spam again. And we're again doing "if from there it's spam"...