RE: [cobalt-users] Bounce it based on Content

[BSmith@xxxxxxxxxxx]

-----Original Message-----
From: Domain Management Services
[mailto:DMS@xxxxxxxxxxxxxxxxxxxxxxxxxxxx]
Sent: Wednesday, June 11, 2003 11:37 AM
To: cobalt-users@xxxxxxxxxxxxxxx
Subject: RE: [cobalt-users] Bounce it based on Content


http://spamcop.net/fom-serve/cache/290.html

I wish I knew how to do this   for sendmail  but when I do....

PCOII

-----Original Message-----


There is a whole selection on doing it in Sendmail :)

http://spamcop.net/fom-serve/cache/294.html


Bruce had put out an email, here is the contents ... I use it
to, plus on his site, he offers a crap load of hosts to block!

blocked.txt

There are also instructions some where on here for SpamAssasin.
This is not the original site, just a copy of the page
http://www.nuonce.net/cobalt-mailscanner.php


These 3 things should help you go good ... for not only content
but also for most of the Spam.


---] All his [---
> Make sure you make a copy of the cobalt.mc and especially the
> sendmail.cf files before you start.

Good point - I forgot the first step:

cd /usr/lib/sendmail-cf/cf
cp cobalt.mc cobalt.mc.safe

*Then* edit cobalt.mc and add these entries:

FEATURE(`dnsbl',`relays.ordb.org',`554 Rejected - see http://ordb.org/')dnl
FEATURE(`dnsbl',`bl.spamcop.net',`554 Rejected - see
http://spamcop.net/')dnl
FEATURE(`dnsbl',`sbl.spamhaus.org',`554 Rejected - see
http://spamhaus.org/')dnl
FEATURE(`dnsbl',`blackholes.mail-abuse.org',`554 Rejected - see
http://mail-abuse.org/')dnl
FEATURE(`dnsbl',`dialups.mail-abuse.org',`554 Dialup rejected - see
http://www.mail-abuse.org/dul/')dnl
FEATURE(`dnsbl',`relays.visi.com',`554 Known spammer site see:
http://relays.visi.com')dnl
FEATURE(`dnsbl',`dnsbl.njabl.org',`554 Message from $&{client_addr}
rejected - see http://njabl.org/')dnl
FEATURE(`dnsbl', `relays.osirusoft.com', `554 Open spam relay - see
http://relays.osirusoft.com/')dnl

(Each FEATURE line is one line).

Then

cd /usr/lib/sendmail-cf
m4 cf/cobalt.mc > /etc/mail/spamblock.cf
cd /etc/mail
cp sendmail.cf sendmail.cf.orig
cp spamblock.cf sendmail.cf
/etc/rc.d/init.d/sendmail restart

> I also only added the first two and last two that Bruce did and I get
> almost no spam anymore.

I found the others during a search for all the possible DNSRBL entries, and 
thought I'd just throw them all in for the heck of it.

Anecdotal success story: since I did this, 3 spams have sneaked through in 
the last 48 hours, and over 100 were turned away.  This plus some good 
procmail rules should keep "everything" at bay...