How can I block this spam coming via Google?

Need ratelimitter from exim.conf, pure spamassassin can't prevent this anymore since it validate/pass rDNS, DKIM, SPF. So the spam score become -15

The one feature that DA still missing, but it's gonna has the problem with big email service like gmail or hotmail, it gonna trigger the ratelimit faster than other mail service.
 
A ratelimitter won't fix this either because it's not like we are receiving them in a high rate flow, they are several a day and it's very annoying.

Google and Microsoft should just stop using this service or protect things better. Otherwise it's better to block everything coming from gmail which is not from @gmail.com address I think. I just don't know how to do that yet.
Although this would also block a lot of valid domains.
 
I didn't read the whole thread, but this right here goes in /etc/exim.acl_check_recipient.pre.conf:

Code: 
# Nice try fuckers
deny    message   = Envelope sender domain not permitted
        !senders  = /etc/exim/firebaseapp_whitelist
        condition = ${if match{$sender_address_domain}{\N(^|\.)firebaseapp\.com$\N}{yes}{no}}

Then you whitelist the exceptions in /etc/exim/firebaseapp_whitelist (touch the file first if you keep the whitelist).

It's hard to stay on top of all of the trends, you can see my whole exim.acl_check_recipient.pre.conf here:

Shared paste · MXroute

paste.mxroute.com paste.mxroute.com

It just keeps growing and growing as trends change. With AI involved now, the chase never ends. That's why I'm working on a hybrid in-house LLM filtering model. Btw don't drop my whole exim.acl_check_recipient.pre.conf into yours, exim won't reload, it has dependencies.
 
mxroute said:
Then you whitelist the exceptions in /etc/exim/firebaseapp_whitelist (touch the file first if you keep the whitelist).
Click to expand...
Thank you very much, but I think here is where it would go wrong for me.

I'm no scripter so often I don't really understand these things fully. But doesn't this block everything except what is in the whitelist? Or am I misunderstanding something here?

Would be very hard for me and I also would like to use whitelists to a minimum if possible. To me it's only important that only all mails from gmail.com are also originated from gmail.com and not from some other domain which is sending via gmail.com.

I loved your RBL earlier, unfortunately I had to disable it (also asked by my collegue who pays for the server), because it blocked just a bit too many good addresses.

mxroute said:
It just keeps growing and growing as trends change.
Click to expand...
Very big list you got there, LoL. Looks good. I think I might be able to get some more interesting out of it.
 
Richard G said:
But doesn't this block everything except what is in the whitelist
Click to expand...

Everything from firebase addresses. Which, frankly, your whitelist is likely to remain empty. No one important sends email from a firebase hostname as the envelope sender.
 
I'm from an era where you could use telnet to send mail, as anyone, to anywhere. Glorious times! :)
Our best defence at that time was "if it's from there and has d*ck in it, it's spam". And now we're back full circle where spammers simply make sure the hurdles we throw at them are taken and they spam again. And we're again doing "if from there it's spam"... :)
 
sysdev said:
I'm from an era where you could use telnet to send mail,
Click to expand...
On a lot of servers that is still working. :)

I'm now looking for a "if it's from there, but not created their /except forwardings/ then it's spam". :)
Which is not really true either in several cases but Google should just take better care that these things are not happening.
If they provide the service to pickup mail from other domains, they should make rules stricter and not use their own spf and dkim and such. Or take better countermeasures another way.
Otherwise you're not worth being on the dnsbwl (or what's it called) whitelist.
 
hello, are you sure you want to blocked all the incoming email that coming from google group but by their customer custom email ?

#/etc/exim.acl_check_message.pre.conf
Code: 
deny
    hosts = google.com : *.google.com
    !sender_domains = gmail.com : googlemail.com : google.com : googlegroups.com
    message = Rejected: non-Google sender relayed through Google ($sender_address)
    log_message = BLOCK_GOOGLE_RELAY sender=$sender_address host=$sender_host_name ip=$sender_host_address
Code: 
exim -bV
systemctl restart exim

The example data:
Code: 
Received: from mail-wm1-x347.google.com ([2a00:1450:4864:20::347])
(envelope-from <[email protected]>)


Google SMTP server       -> YES
sender domain sh4y.de    -> not allowed
                          -> REJECT
this still allowed sender from google itself, but any customize domain will blocked, adjust "$sender_domains" allowed list as you want,


########### spamassassin rules ##########
#/etc/mail/spamassassin/local.cf
Code: 
header __FROM_GOOGLE_RELAY X-Spam-Relays-External =~ /\brdns=\S*\.google\.com\b/i

header __GOOGLE_ALLOWED_FROM From:addr =~ /\@(gmail\.com|googlemail\.com|google\.com|googlegroups\.com)$/i

meta GOOGLE_RELAY_NON_GOOGLE_FROM (__FROM_GOOGLE_RELAY && !__GOOGLE_ALLOWED_FROM)

describe GOOGLE_RELAY_NON_GOOGLE_FROM Google SMTP relay with non-Google From domain
score GOOGLE_RELAY_NON_GOOGLE_FROM 30.0

NOTE: this is answer coming from chatgpt with provide clear answer and result
 
Last edited:
You must log in or register to reply here.
Back
Top