dnl dnl проверка A записей домена отправителя dnl dnl (несуществующие домены из зон .net и .com могут иметь A запись 64.94.110.11) dnl NO - не проводить проверку dnl REJECT - возврат клиенту кода 5xx dnl DEFER - возврат клиенту кода 451 dnl WARN - вывод в лог файл предупреждения dnl QUARANTINE - принять письмо с сохранением в карантин без доставки получателям dnl GREYLIST:XX - добавить XX баллов к счетчику опционального грейлистинга dnl REJECT:XX - добавить XX баллов к счетчику опционального reject'а dnl DELAY:XX - задержка XX секунд перед ответом на RCPT TO dnl define(`confCHECK_ACCESS_MAIL_DOMAIN_A', `YES')dnl dnl dnl черный список А записей доменов отправителей находятся в файле CONFDIR/access-mail-domain-a dnl в виде: dnl a_record : действие : сообщение dnl dnl при значении YES переменной confIPv6 в файле CONFDIR/access-mail-domain-a dnl кроме A записей доменов можно указывать AAAA записи в двойных кавычках dnl dnl в качестве "действия" могут выступать: dnl ok - принимать сообщения dnl warn - выдача предупреждения в лог файл и в заголовки письма dnl и добавление в заголовки сообщения поле X-Warn-Mail-MX dnl текст сообщения об ошибке может быть указан через двоеточие dnl deny или reject - отказ в приеме сообщения dnl drop - отказ в приеме сообщения с обрывом соединения dnl discard - прием письма без доставки получателю dnl defer - возврат клиенту временной ошибки 4xx dnl quarantine - принять письмо с сохранением в карантин без доставки получателям dnl greylist=xx - добавление xx баллов к счетчику опционального greylisting'а dnl greylisting=xx - синоним greylist=xx dnl reject=yy - добавление yy баллов к счетчику опционального reject'а dnl deny=yy - синоним reject=yy dnl delay=zz - задержка на zz секунд перед продолжением обработки сообщения dnl pause=zz - синоним delay=zz dnl submit_mysql - занесение записи о хосте в базу MySQL dnl submit_sqlite - занесение записи о хосте в базу SQLite dnl submit_rbl - занесение записи о хосте в DNSBL dnl dnl если в файле CONFDIR/access-mail-domain-a будет отсутствовать поле "действие", dnl то будет выполнено действие по умолчанию из переменно confCHECK_ACCESS_MAIL_DOMAIN_A dnl поле "сообщение" может отсутствовать dnl dnl пример: dnl # dnl # http://www.imperialviolet.org/dnsfix.html dnl # dnl 64.94.110.11 : deny : 5.1.8 Just coz VerSign says your domain exists doesnt mean it really does. dnl 194.205.62.122 : deny : 5.1.8 194.205.62.122 - A record for nonexistent domains from .AC and .CC zones dnl 216.220.34.101 : deny : 5.1.8 216.220.34.101 - A record for nonexistent domains from .BZ zone dnl 206.253.214.102 : deny : 5.1.8 206.253.214.102 - A record for nonexistent domains from .CC zone dnl 159.226.7.162 : deny : 5.1.8 159.226.7.162 - A record for nonexistent domains from .CN zone dnl 219.88.106.80 : deny : 5.1.8 219.88.106.80 - A record for nonexistent domains from .CX zone dnl 202.128.12.163 : deny : 5.1.8 202.128.12.163 - A record for nonexistent domains from .MP zone dnl 195.7.77.20 : deny : 5.1.8 195.7.77.20 - A record for nonexistent domains from .MUSEUM zone dnl 64.55.105.9 : deny : 5.1.8 64.55.105.9 - A record for nonexistent domains from .NU zone dnl 212.181.91.6 : deny : 5.1.8 212.181.91.6 - A record for nonexistent domains from .NU zone dnl 203.119.4.6 : deny : 5.1.8 203.119.4.6 - A record for nonexistent domains from .PH zone dnl 216.98.141.250 : deny : 5.1.8 216.98.141.250 - A record for nonexistent domains from .PW zone dnl 65.125.231.178 : deny : 5.1.8 65.125.231.178 - A record for nonexistent domains from .PW zone dnl 194.205.62.62 : deny : 5.1.8 194.205.62.62 - A record for nonexistent domains from .SH zone dnl 146.101.245.154 : deny : 5.1.8 146.101.245.154 - A record for nonexistent domains from .TD zone dnl 195.20.32.83 : deny : 5.1.8 195.20.32.83 - A record for nonexistent domains from .TK zone dnl 195.20.32.86 : deny : 5.1.8 195.20.32.86 - A record for nonexistent domains from .TK zone dnl 194.205.62.42 : deny : 5.1.8 194.205.62.42 - A record for nonexistent domains from .TM zone dnl 203.73.24.11 : deny : 5.1.8 203.73.24.11 - A record for nonexistent domains from .TW zone dnl 216.35.187.246 : deny : 5.1.8 216.35.187.246 - A record for nonexistent domains from .WS zone dnl define(`confACL_DNSDB', `1')dnl # Проверка A записей домена отправителя warn set acl_m0 = skip set acl_m_check_domain_a = A condition = ${if eq{$sender_address_domain}{}{no}{yes}} condition = ${if match_domain{$sender_address_domain}\ {+local_domains ifdef(`confSECONDARY_RELAY', `ifelse(confSECONDARY_RELAY, `NO', `', `: +relay_to_domains')')}\ {no}{yes}} condition = ${lookup{$sender_address_domain}wildlsearch{CONFDIR/access-mail-domain-a}{\ ${if eq{${lc:$value}}{ok}{no}{yes}}\ }{yes}} set acl_m0 = warn condition = ${if eq{$acl_m0}{skip}{no}{yes}} set acl_m_iplsearch_result = acl = acl_dnsdb a=$sender_address_domain condition = ${if eq{$acl_m_dnsdb_result}{defer}{no}{yes}} acl = acl_iplsearch CONFDIR/access-mail-domain-a "$acl_m_dnsdb_result" set acl_m0 = ${if match{$acl_m_iplsearch_result}{\N.+(lookup |\$\{|[\{\}])\N}{${expand:$acl_m_iplsearch_result}}{$acl_m_iplsearch_result}} ifelse_strstr(confIPv6, `YES', `dnl warn condition = ${if eq{$acl_m0}{}{yes}{no}} set acl_m_iplsearch_result = acl = acl_dnsdb aaaa=$sender_address_domain condition = ${if eq{$acl_m_dnsdb_result}{defer}{no}{yes}} acl = acl_iplsearch CONFDIR/access-mail-domain-a "$acl_m_dnsdb_result" set acl_m0 = ${if match{$acl_m_iplsearch_result}{\N.+(lookup |\$\{|[\{\}])\N}{${expand:$acl_m_iplsearch_result}}{$acl_m_iplsearch_result}} condition = ${if eq{$acl_m0}{}{no}{yes}} set acl_m_check_domain_a = AAAA ') dnl ifelse_strstr(confIPv6, `YES', `') defer condition = ${if eq{$acl_m0}{skip}{no}{yes}} condition = ${if eq{$acl_m_dnsdb_result}{defer}{yes}{no}} log_message = Could not resolve $acl_m_check_domain_a record for sender domain $sender_address_domain message = Could not resolve $acl_m_check_domain_a record for sender domain $sender_address_domain warn set acl_m1 = condition = ${if eq{$acl_m0}{skip}{no}{yes}} condition = ${if eq{$acl_m0}{}{no}{yes}} acl = acl_normalize_action "${extract{1}{:}{$acl_m0}}" set acl_m1 = ${sg{$acl_m_normalize_action_result }{\N\b([^=\s\d]+)(\s)\N}{\$1=00\$2}} # message = $acl_m2 # log_message = $acl_m0 set acl_m2 = ${expand:${sg{${extract{2}{:}{$acl_m_iplsearch_result}}}{\N^\s+\N}{}}} set acl_m2 = ${if eq{$acl_m2}{}{Access denied}{$acl_m2}} set acl_m0 = ${expand:${sg{${extract{3}{:}{$acl_m_iplsearch_result}}}{\N^\s+\N}{}}} set acl_m_check_mail_a_msg = ${if eq{$acl_m0}{}{}{: $acl_m0}} set acl_m0 = ${if eq{$acl_m0}{}{Domain of sender $sender_address_domain has bad $acl_m_check_domain_a record${if eq{$acl_m2}{}{}{: $acl_m2}}}{$acl_m0}} ifdef(`confENTERPRISE_USER', `dnl warn condition = ${if match{$acl_m1}{submit_mysql}{yes}{no}} ENTERPRISE(`mysql', `submit', `mail a', `blacklisted', `$sender_address', `0') warn condition = ${if match{$acl_m1}{submit_sqlite}{yes}{no}} ENTERPRISE(`sqlite', `submit', `mail a', `blacklisted', `$sender_address', `0') warn condition = ${if match{$acl_m1}{submit_rbl}{yes}{no}} dnl ENTERPRISE(`rbl', `update', `mx.org.ua', `maila.rbl.mx.org.ua', `blacklisted', `$sender_address') ENTERPRISE(`rbl', `submit', `maila', `blacklisted', `$sender_address') ')dnl warn condition = ${if match{$acl_m1}{warn}{yes}{no}} log_message = $acl_m0 add_header = X-Warn-Mail-A: $acl_m0 warn condition = ${if eq{${extract{pause}{$acl_m1}}}{}{no}{yes}} delay = ${extract{pause}{$acl_m1}}s set acl_m_spam_action = ${acl_m_spam_action}\t\ delay=${extract{pause}{$acl_m1}}s\t\t\ $acl_m0\n # quarantine and !reject warn condition = ${if eq{${extract{quarantine}{$acl_m1}}}{00}{yes}{no}} condition = ${if eq{${extract{reject}{$acl_m1}}}{00}{no}{yes}} add_header = X-Quarantine-Mail-A: Domain of sender $sender_address_domain has bad $acl_m_check_domain_a record${acl_m_check_mail_a_msg} log_message = message will be quarantined: Domain of sender $sender_address_domain has bad $acl_m_check_domain_a record set acl_m_add_x_orig_rcpt = yes set acl_m_quarantined = $acl_m_quarantined envelope accept condition = ${if eq{${extract{quarantine}{$acl_m1}}}{00}{yes}{no}} condition = ${if eq{${extract{reject}{$acl_m1}}}{00}{no}{yes}} # quarantine and reject accept condition = ${if eq{${extract{quarantine}{$acl_m1}}}{00}{yes}{no}} condition = ${if eq{${extract{reject}{$acl_m1}}}{00}{yes}{no}} log_message = message will be quarantined: Domain of sender $sender_address_domain has bad $acl_m_check_domain_a record set acl_m_fakereject = \ message will be quarantined: Domain of sender $sender_address_domain has bad $acl_m_check_domain_a record\ |X-Quarantine-Mail-A: Domain of sender $sender_address_domain has bad $acl_m_check_domain_a record${acl_m_check_mail_a_msg}\ |${expand:$acl_m2} set acl_m_add_x_orig_rcpt = yes set acl_m_quarantined = $acl_m_quarantined envelope # !quarantine and reject deny condition = ${if eq{${extract{reject}{$acl_m1}}}{00}{yes}{no}} condition = ${if eq{${extract{quarantine}{$acl_m1}}}{00}{no}{yes}} log_message = $acl_m0 message = ${expand:$acl_m2} defer condition = ${if match{$acl_m1}{defer}{yes}{no}} log_message = $acl_m0 message = $acl_m2 drop condition = ${if match{$acl_m1}{drop}{yes}{no}} log_message = $acl_m0 message = $acl_m2 discard condition = ${if match{$acl_m1}{discard}{yes}{no}} log_message = $acl_m0 ifelse(confGREYLIST, `OPTIONAL', `dnl warn condition = ${if eq{${extract{greylist}{$acl_m1}}}{}{no}{yes}} set acl_m_optional_greylist = \ scores=${eval:${extract{scores}{$acl_m_optional_greylist}}+${extract{greylist}{$acl_m1}}} \ log_message="${extract{log_message}{$acl_m_optional_greylist}} $acl_m0;" set acl_m_spam_action = ${acl_m_spam_action}\t\ greylist scores=${extract{greylist}{$acl_m1}}\t\ $acl_m0\n ') dnl ifelse(confGREYLIST, `OPTIONAL', `') ifdef(`confOPTIONAL_REJECT', `ifelse(confOPTIONAL_REJECT, `NO', `dnl', `dnl warn condition = ${if eq{${extract{reject}{$acl_m1}}}{}{no}{yes}} condition = ${if eq{${extract{reject}{$acl_m1}}}{00}{no}{yes}} set acl_m_optional_reject = \ scores=${eval:${extract{scores}{$acl_m_optional_reject}}+${extract{reject}{$acl_m1}}} \ log_message="${extract{log_message}{$acl_m_optional_reject}} $acl_m0;" set acl_m_spam_action = ${acl_m_spam_action}\t\ reject scores=${extract{reject}{$acl_m1}}\t\t\ $acl_m0\n ')') dnl ifdef(`confOPTIONAL_REJECT', `ifelse(confOPTIONAL_REJECT, `NO', `', `')')