--- Ken A <[EMAIL PROTECTED]> wrote:
>
>
> Jon D. Slater wrote:
> > I know this is a bit off topic, but does anyone know a good source
> that
> > breaks down IP addresses by country?
> >
> >
> >
> > Ive added a number of IP addresses to my hosts.deny file just from
> > experience.
> >
> >
> >
> > My server never gets e-mail from countries outside of the US. So,
> Im
> > looking for an effective way to block by country.
>
> header __RCVD_IN_NERDS
> eval:check_rbl('nerds','zz.countries.nerd.dk.')
> describe __RCVD_IN_NERDS Received from a spam country
> tflags __RCVD_IN_NERDS net
>
> header RCVD_IN_NERDS_CN
> eval:check_rbl_sub('nerds','127.0.0.156')
> describe RCVD_IN_NERDS_CN Received from China
> tflags RCVD_IN_NERDS_CN net
> score RCVD_IN_NERDS_CN 2.5
I tried this but my glue technology (amavisd-new) appears to spit
errors when I run it in SA debug mode:
[7771] info: config: SpamAssassin failed to parse line, no value
provided for "header", skipping: header __RCVD_IN_NERDS
[7771] info: config: failed to parse line, skipping:
eval:check_rbl('nerds','zz.countries.nerd.dk.')
[7771] info: config: SpamAssassin failed to parse line, no value
provided for "header", skipping: header RCVD_IN_NERDS_CN
[7771] info: config: failed to parse line, skipping:
eval:check_rbl_sub('nerds','127.0.0.156')
[7771] info: config: SpamAssassin failed to parse line, no value
provided for "header", skipping: header RCVD_IN_NERDS_KR
[7771] info: config: failed to parse line, skipping:
eval:check_rbl_sub('nerds','127.0.0.154')
What I did is add the following to local.cf:
header __RCVD_IN_NERDS
eval:check_rbl('nerds','zz.countries.nerd.dk.')
describe __RCVD_IN_NERDS Received from a spam country
tflags __RCVD_IN_NERDS net
header RCVD_IN_NERDS_CN
eval:check_rbl_sub('nerds','127.0.0.156')
describe RCVD_IN_NERDS_CN Received from China
tflags RCVD_IN_NERDS_CN net
score RCVD_IN_NERDS_CN 2.0
header RCVD_IN_NERDS_KR
eval:check_rbl_sub('nerds','127.0.0.154')
describe RCVD_IN_NERDS_KR Received from Rep. of Korea
tflags RCVD_IN_NERDS_KR net
score RCVD_IN_NERDS_KR 2.0
Peter
__________________________________________________
Do You Yahoo!?
Tired of spam? Yahoo! Mail has the best spam protection around
http://mail.yahoo.com
