Exim - block incoming mail from blacklisted IPS only

Question

I would like to check for blacklists only for incoming e-mail. I have users who usually get dynamic IP's which are blacklisted so they are not able to send the e-mail if I turn the blacklist option on. How could I achieve that ? Also, is there a ways to set automatic deletion of e-mails marked as SPAM ?

Here is my exim cofnfiguration. http://paste.servergur.us/wilumojabi.coffee

score 0 · Answer 1 · answered Oct 10 '14 at 12:25

You have to whitelist legal senders while all others are passed through the blacklist. But far more efficient way is to use SMTPS with authentication.

exim intended to ask spamd about score from the ACL, and if score is high enough - simply reject or blackhole the message. Delivering + deletion is a wasting of resources.

score 0 · Answer 2 · answered Oct 10 '14 at 12:40

Think about it from the opposite direction: You want to limit RBL checks to only those inbound emails which are not coming from authenticated users:

deny message       = rejected because $sender_host_address is in a black list \
                     at $dnslist_domain\\n$dnslist_text
    !authenticated = *
     dnslists      = ${readfile {/etc/exim/dnsbl.conf}{:}}

Your second question can be addressed in two ways. One option is that you can deliver spam directly to the user's Spam folder instead of their Inbox.

# Add X-Spam-Flag if spam is over system-wide threshold for non-authed users
warn   condition      = ${if >{$message_size}{500K}{no}{yes}}
       !authenticated = *
       spam           = exim
       add_header     = X-Spam-Flag: Yes
       set acl_m_filter_to_spam = 1

# In transport which actually delivers the email, if $acl_m_filter_to_spam
# is set, I append ".Spam/" to the maildir delivery path

The other option is that you reject the message instead of accepting it.

# Reject spams with score over limit for non-authed users
deny   condition      = ${if >{$message_size}{500K}{no}{yes}}
       !authenticated = *
       message        = This message scored $spam_score points.  Rejected.
       spam           = exim:true
       condition      = ${if >{${eval10:$spam_score_int/10}}{INBOUND_SPAM_LIMIT}}

In my case, I actually do both of these. I mark an email as spam if it scores a 5.0 or higher. I filter it to the Spam folder if it scores a 5.0 to a 5.9. I reject the email completely if it scores a 6.0 or higher.

Note that the above Spam examples are for regular inbound email. I have that entire section duplicated to scan SMTP Authenticated users that send mail too, I just have different scores enabled/disabled and have set different spam and rejection thresholds.

Exim - block incoming mail from blacklisted IPS only

2 Answers2