Thx. Will do!
--john
On 1/7/24 12:57 PM, mailmary--- via Postfix-users wrote:
Same here, but I found some interesting facts about outlook spam, they have 4
common marks that can be used to catch them with Spamassassin.
The following rules block all outlook spam, but will also block some legitimate emails
that use "undisclosed recipients". Not a big deal for me and my networks, but
be aware of this limitation. To use, simply copy paste the rules under
/etc/mail/spamassassin/outlook.cf (which is the correct location for Enterprise Linix
distros like Alma, Rocky and Oracle).
Here are the rules:
header __SPAM_DOMAIN_OUTLOO1 Received =~
/outbound\.protection\.outlook\.com/i
header __SPAM_DOMAIN_OUTLOO2 From =~
/\@(?:outlook|hotmail)\.com\b/i
header __SPAM_DOMAIN_OUTLOO3 To =~ /undisclosed/i
header __SPAM_DOMAIN_OUTLOO4 To =~ /recipients/i
header __SPAM_DOMAIN_OUTLOO5 exists:To
meta SPAM_DOMAIN_OUTLOO6 (__SPAM_DOMAIN_OUTLOO1 &&
(__SPAM_DOMAIN_OUTLOO3 || __SPAM_DOMAIN_OUTLOO4))
score SPAM_DOMAIN_OUTLOO6 15.0
describe SPAM_DOMAIN_OUTLOO6 Outlook spam with undisclosed
recipients (outloo)
meta SPAM_DOMAIN_OUTLOO7 (__SPAM_DOMAIN_OUTLOO2 &&
MISSING_HEADERS)
score SPAM_DOMAIN_OUTLOO7 15.0
describe SPAM_DOMAIN_OUTLOO7 Outlook spam with missing headers
(outloo)
meta SPAM_DOMAIN_OUTLOO8 (__SPAM_DOMAIN_OUTLOO1 &&
__SPAM_DOMAIN_OUTLOO2 && __TO_EQ_FROM_DOM)
score SPAM_DOMAIN_OUTLOO8 15.0
describe SPAM_DOMAIN_OUTLOO8 Outlook spam, same From/To (outloo)
meta SPAM_DOMAIN_OUTLOO9 (__SPAM_DOMAIN_OUTLOO1 && MISSING_HEADERS
&& !__SPAM_DOMAIN_OUTLOO5)
score SPAM_DOMAIN_OUTLOO9 15.0
describe SPAM_DOMAIN_OUTLOO9 Outlook spam with missing headers,
missing To (outloo)
On Sun, 7 Jan 2024 10:17:56 -0500 John Hill via Postfix-users
<postfix-users@postfix.org> wrote:
First I am really amazed at the amount of support, that's not true
everywhere. I also like the tone of the posts, very respectful.
I have 3.7.9 and all the settings.
Outlook protection is slamming me, 6 to 10 worthless emails every day.
glad they don't make condoms.
I have sent everyone with source back to ab...@outlook.com. They always
automatically thank me.
I can't block outlook, so I gave up and block all onmicrosoft emails.
I'll see how that goes.
--john
_______________________________________________
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org
_______________________________________________
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org
_______________________________________________
Postfix-users mailing list -- postfix-users@postfix.org
To unsubscribe send an email to postfix-users-le...@postfix.org
