sa-updates/20_dynrdns.cf

   1 # SpamAssassin rules file: dynamic-ish rDNS tests
   2 #
   3 # Please don't modify this file as your changes will be overwritten with
   4 # the next update. Use /etc/mail/spamassassin/local.cf instead.
   5 # See 'perldoc Mail::SpamAssassin::Conf' for details.
   6 #
   7 # We should write a new ruletype for these, to save typing.
   8 #
   9 # <@LICENSE>
  10 # Licensed to the Apache Software Foundation (ASF) under one or more
  11 # contributor license agreements.  See the NOTICE file distributed with
  12 # this work for additional information regarding copyright ownership.
  13 # The ASF licenses this file to you under the Apache License, Version 2.0
  14 # (the "License"); you may not use this file except in compliance with
  15 # the License.  You may obtain a copy of the License at:
  16 #
  17 #     http://www.apache.org/licenses/LICENSE-2.0
  18 #
  19 # Unless required by applicable law or agreed to in writing, software
  20 # distributed under the License is distributed on an "AS IS" BASIS,
  21 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  22 # See the License for the specific language governing permissions and
  23 # limitations under the License.
  24 # </@LICENSE>
  25 #
  26 ###########################################################################
  27
  28 require_version 3.004006
  29
  30 # ---------------------------------------------------------------------------
  31
  32 # Note the '^[^\]]+ ' stanza: this ensures that we only match spamware
  33 # connecting to a internal relay; if a mail came from a dynamic addr but
  34 # was relayed through their smarthost, that's fine.
  35
  36 # See bug #5856, all references of "trusted" were changed to "external"
  37
  38 # All of the RDNS_DYNAMIC rules require that the last external relay
  39 # did not use SMTP authentication.  These rules should not be firing on
  40 # friendlies!
  41 header __LAST_UNTRUSTED_RELAY_NO_AUTH X-Spam-Relays-Untrusted =~ /^[^\]]+ auth= /
  42 header __LAST_EXTERNAL_RELAY_NO_AUTH X-Spam-Relays-External =~ /^[^\]]+ auth= /
  43
  44 # dhcp024-210-034-053.columbus.rr.com [24.210.34.53]
  45 # c-66-176-16-108.se.client2.attbi.com [66.176.16.108]
  46 # c-67-168-174-61.client.comcast.net [67.168.174.61]
  47 # NNN-NNN-NNN-NNN.fibertel.com.ar
  48 # NN.NN.NNN.NNN.ap.yournet.ne.jp
  49 # NN.NNN.NN-NN.rev.gaoland.net
  50 # vaise-1-82-67-44-166.fbx.proxad.net [82.67.44.166]
  51 # lns-vlq-11-62-147-186-141.adsl.proxad.net [62.147.186.141]
  52 # dsl-200-95-109-107.prod-infinitum.com.mx [200.95.109.107]
  53 # port-212-202-77-203.reverse.qsc.de [212.202.77.203]
  54 # pool-151-203-32-68.bos.east.verizon.net [151.203.32.68]
  55 # c-67-164-133-216.client.comcast.net [67.164.133.216]
  56 # 200-171-228-6.customer.telesp.net.br [200.171.228.6]
  57 # modemcable090.28-201-24.mc.videotron.ca [24.201.28.90]
  58 # 80-218-47-160.dclient.hispeed.ch [80.218.47.160]
  59 # cdm-68-226-239-16.laft.cox-internet.com [68.226.239.16]
  60 # d53-64-35-171.nap.wideopenwest.com [64.53.171.35]
  61 # 74.67-201-80.adsl.skynet.be [80.201.67.74]
  62 # 12-218-225-223.client.mchsi.com [12.218.225.223]
  63 # pptp-81-30-186-139.ufanet.ru [81.30.186.139]
  64 # (require an alpha first, as legit HELO'ing-as-IP-address is hit otherwise)
  65 header __RDNS_DYNAMIC_IPADDR X-Spam-Relays-External =~ /^[^\]]+ rdns=(?![^\s\]]+[-.]static[-.])\S*\d+[^\d\s]\d+[^\d\s]\d+[^\d\s]\d+\S*\.\S+\.\S/i
  66 describe __RDNS_DYNAMIC_IPADDR Relay HELO'd using suspicious hostname (IP addr 1)
  67
  68 # dhcp024-210-034-053.columbus.rr.com [24.210.34.53]
  69 # catv-506237d8.miskcatv.broadband.hu [80.98.55.216]
  70 # node-c-8b22.a2000.nl
  71 # cm89.omega139.maxonline.com.sg
  72 # cm114.gamma208.maxonline.com.sg
  73 header __RDNS_DYNAMIC_DHCP X-Spam-Relays-External =~ /^[^\]]+ rdns=\S*(?:cm|catv|docsis|cable|dsl|dhcp|cpe|node)\S*\d+[^\d\s]+\d/i
  74 describe __RDNS_DYNAMIC_DHCP Relay HELO'd using suspicious hostname (DHCP)
  75
  76 # fia83-8.dsl.hccnet.nl [62.251.8.83]
  77 # fia160-115-100.dsl.hccnet.nl [80.100.115.160]
  78 header __RDNS_DYNAMIC_HCC   X-Spam-Relays-External =~ /^[^\]]+ rdns=\S*\d+[^\d\s]+\d+\S*\.(?:docsis|cable|dsl|adsl|dhcp|cpe)\./i
  79 describe __RDNS_DYNAMIC_HCC Relay HELO'd using suspicious hostname (HCC)
  80
  81 # h0002a5d76857.ne.client2.attbi.com [65.96.12.59]
  82 header __RDNS_DYNAMIC_ATTBI  X-Spam-Relays-External =~ /^[^\]]+ rdns=\S+\d+\S+\.client2\.attbi\.com/i
  83 describe __RDNS_DYNAMIC_ATTBI Relay HELO'd using suspicious hostname (ATTBI.com)
  84
  85 # CPE0004e2372711-CM000a73666706.cpe.net.cable.rogers.com
  86 # CPE00e0184f0eba-CM014490118324.cpe.net.cable.rogers.com [24.43.109.140]
  87 header __RDNS_DYNAMIC_ROGERS X-Spam-Relays-External =~ /^[^\]]+ rdns=CPE\d+\S+\.rogers\.com/i
  88 describe __RDNS_DYNAMIC_ROGERS Relay HELO'd using suspicious hostname (Rogers)
  89
  90 # ca-morpark-cuda1-zone7-b-159.vnnyca.adelphia.net[67.23.129.159]
  91 # tn-greenvillecuda1cable7a-36.atlaga.adelphia.net [68.171.113.36]
  92 # ky-richmond2a-123.rhmdky.adelphia.net [68.71.36.123]
  93 # ny-lackawannacadent4-chtwga3a-b-117.buf.adelphia.net [68.71.205.117]
  94 # fl-edel-u2-c3c-233.pbc.adelphia.net [68.64.89.233]
  95 header __RDNS_DYNAMIC_ADELPHIA X-Spam-Relays-External =~ /^[^\]]+ rdns=[a-z]{2}-\S+-\d{1,3}\.[a-z]{3,8}\.adelphia\.net/i
  96 describe __RDNS_DYNAMIC_ADELPHIA Relay HELO'd using suspicious hostname (Adelphia)
  97
  98 # pD9E4F89F.dip.t-dialin.net [217.228.248.159]
  99 header __RDNS_DYNAMIC_DIALIN X-Spam-Relays-External =~ /^[^\]]+ rdns=[a-z][A-F0-9]+\.dip\./
 100 describe __RDNS_DYNAMIC_DIALIN Relay HELO'd using suspicious hostname (T-Dialin)
 101
 102 # 0xd5aaf40b.dhcp.kabelnettet.dk
 103 # 0x50a46949.virnxx11.adsl-dhcp.tele.dk
 104 header __RDNS_DYNAMIC_HEXIP X-Spam-Relays-External =~ /^[^\]]+ rdns=0x[a-f0-9]{8}\./
 105 describe __RDNS_DYNAMIC_HEXIP Relay HELO'd using suspicious hostname (Hex IP)
 106
 107 # 118.Red-80-35-201.pooles.rima-tde.net
 108 header __RDNS_DYNAMIC_SPLIT_IP X-Spam-Relays-External =~ /^[^\]]+ rdns=\d+\.\S+\d+[^\d\s]\d+[^\d\s]\d+[^\d\s]/
 109 describe __RDNS_DYNAMIC_SPLIT_IP Relay HELO'd using suspicious hostname (Split IP)
 110
 111 # YahooBB219173000034.bbtec.net [219.173.0.34]
 112 header __RDNS_DYNAMIC_YAHOOBB X-Spam-Relays-External =~ /^[^\]]+ rdns=YahooBB/i
 113 describe __RDNS_DYNAMIC_YAHOOBB Relay HELO'd using suspicious hostname (YahooBB)
 114
 115 # ool-18be1aaf.dyn.optonline.net [24.190.26.175]
 116 header __RDNS_DYNAMIC_OOL X-Spam-Relays-External =~ /^[^\]]+ rdns=\S+\.dyn\.optonline\.net/
 117 describe __RDNS_DYNAMIC_OOL Relay HELO'd using suspicious hostname (OptOnline)
 118
 119 # wiley-170-10231.roadrunner.nf.net [205.251.210.249]
 120 header __RDNS_DYNAMIC_RR2   X-Spam-Relays-External =~ /^[^\]]+ rdns=[a-z]+-\d{1,3}-\d{1,5}\.roadrunner/i
 121 describe __RDNS_DYNAMIC_RR2 Relay HELO'd using suspicious hostname (RR 2)
 122
 123 # pcp04024417pcs.toresd01.pa.comcast.net [68.86.206.126]
 124 # bgp542174bgs.ewndsr01.nj.comcast.net[68.38.144.91]
 125 # Computer-udp135632uds.union01.nj.comcast.net [68.39.99.32]
 126 header __RDNS_DYNAMIC_COMCAST X-Spam-Relays-External =~ /^[^\]]+ rdns=[a-z-]+\d+[a-z]{3}\.[a-z0-9]+\...\.comcast/i
 127 describe __RDNS_DYNAMIC_COMCAST Relay HELO'd using suspicious hostname (Comcast)
 128
 129 # h234n2fls32o895.telia.com [217.208.73.234]
 130 # h53n2fls32o828.telia.com
 131 # h116n2fls32o1111.telia.com
 132 # h29n1fls306o1003.telia.com
 133 header __RDNS_DYNAMIC_TELIA X-Spam-Relays-External =~ /^[^\]]+ rdns=h\d+n\d+fls\S+\.telia\.com/i
 134 describe __RDNS_DYNAMIC_TELIA Relay HELO'd using suspicious hostname (Telia)
 135
 136 # CM-vina5-168-207.cm.vtr.net [200.104.168.207]
 137 # CM-anto1-98-153.cm.vtr.net [200.104.98.153]
 138 header __RDNS_DYNAMIC_VTR X-Spam-Relays-External =~ /^[^\]]+ rdns=cm-[a-z]+\d+-\d+-\d+\.cm\.vtr/i
 139 describe __RDNS_DYNAMIC_VTR Relay HELO'd using suspicious hostname (VTR)
 140
 141 # ec9z5l.cm.chello.no
 142 header __RDNS_DYNAMIC_CHELLO_NO  X-Spam-Relays-External =~ /^[^\]]+ rdns=\S+\.cm\.chello\.no/i
 143 describe __RDNS_DYNAMIC_CHELLO_NO Relay HELO'd using suspicious hostname (Chello.no)
 144
 145 # g225174.upc-g.chello.nl
 146 # a151145.upc-a.chello.nl
 147 # a96134.upc-a.chello.nl
 148 header __RDNS_DYNAMIC_CHELLO_NL  X-Spam-Relays-External =~ /^[^\]]+ rdns=[a-z]\d+\.upc-[a-z]\.chello\.nl/i
 149 describe __RDNS_DYNAMIC_CHELLO_NL Relay HELO'd using suspicious hostname (Chello.nl)
 150
 151 # MG001182.user.veloxzone.com.br
 152 # ba199058073.user.veloxzone.com.br
 153 header __RDNS_DYNAMIC_VELOX  X-Spam-Relays-External =~ /^[^\]]+ rdns=[a-z]{2}\d+\.user\.veloxzone\./i
 154 describe __RDNS_DYNAMIC_VELOX Relay HELO'd using suspicious hostname (Veloxzone)
 155
 156 # public4-seve6-5-cust173.lond.broadband.ntl.com
 157 # spr1-bolt5-5-0-cust9.manc.broadband.ntl.com
 158 # spc1-lewi4-6-0-cust190.lond.broadband.ntl.com
 159 header __RDNS_DYNAMIC_NTL  X-Spam-Relays-External =~ /^[^\]]+ rdns=\S+\d+-\d+-cust\d+\.[a-z]{4,6}\.broadband\.ntl\.com/i
 160 describe __RDNS_DYNAMIC_NTL Relay HELO'd using suspicious hostname (NTL)
 161
 162 # (I'm quite sure these may be a good spamsign in future)
 163 # nwblwi-nrp3-l10-a671.nwblwi.tds.net
 164 header __RDNS_DYNAMIC_TDS X-Spam-Relays-External =~ /^[^\]]+ rdns=\S+-[a-z]\d+\.[a-z]{6}\.tds\.net/i
 165 header __RDNS_DYNAMIC_VIRTUA  X-Spam-Relays-External =~ /^[^\]]+ rdns=\d+\.cps\./i
 166
 167 # sp1-c700-131.spacelan.ne.jp
 168 header __RDNS_DYNAMIC_SPACELAN X-Spam-Relays-External =~ /^[^\]]+ rdns=\S+-[a-z]\d+-\d+\./i
 169
 170 # rDNS host-type indicators, as per
 171 # https://tools.ietf.org/id/draft-msullivan-dnsop-generic-naming-schemes-00.txt
 172 header __RDNS_INDICATOR_DYN   X-Spam-Relays-External =~ /^[^\]]+ rdns=\S+[\-\.]dyn(?:amic)?[\-\.]/i
 173
 174 # surprisingly large ham hitrate
 175 header __RDNS_INDICATOR_TYPE  X-Spam-Relays-External =~ /^[^\]]+ rdns=\S+[\-\.](?:dial|modem|isdn|dov|\S?dsl|cable|wireless)[\-\.]/i
 176
 177 # this hits a little ham, not too much though
 178 header __RDNS_INDICATOR_RES   X-Spam-Relays-External =~ /^[^\]]+ rdns=\S+[\-\.](?:res|resnet|client)[\-\.]/i
 179
 180 # these are non-standard, but common in the field; 100% spam correlation!
 181 # (I think that's a fluke)
 182 header __RDNS_INDICATOR_TYPE2 X-Spam-Relays-External =~ /^[^\]]+ rdns=\S+[\-\.](?:docsis|dhcp|cpe|catv)[\-\.]/i
 183
 184 # dsl.dynamic8510023760.ttnet.net.tr
 185 header __RDNS_DYNAMIC_TTNET   X-Spam-Relays-External =~ /^[^\]]+ rdns=\S+[\-\.]dyn(?:amic)?\d/i
 186
 187 # c221106.ppp.asahi-net.or.jp
 188 # i253064.ppp.asahi-net.or.jp
 189 # u035201.ppp.asahi-net.or.jp
 190 # w158034.ppp.asahi-net.or.jp
 191 header __RDNS_DYNAMIC_ASAHI   X-Spam-Relays-External =~ /^[^\]]+ rdns=[a-z][0-9]+\.ppp\.asahi-net\.or\.jp/i
 192
 193 # exceptions (bug 5397):
 194 # exceptions: 66-220-155-151.mail-mail.facebook.com
 195 # exceptions: o167-89-97-77.outbound-mail.sendgrid.net (bug 7592)
 196 header  __RDNS_STATIC         X-Spam-Relays-External =~ /^[^\]]+ rdns=\S*(?:fix|static|fixip|dedicated|mail\-mail|outbound-mail|smtp)/i
 197
 198 # bug 5586:
 199 header __CGATE_RCVD       Received =~ /by \S+ \(CommuniGate Pro/
 200 # bug 5926:
 201 header __DOMINO_RCVD      Received =~ /by \S+ \(Lotus Domino /
 202
 203 header __RDNS_NONE  X-Spam-Relays-External =~ /^[^\]]+ rdns= /
 204
 205 ###########################################################################
 206
 207 meta RDNS_DYNAMIC   (__LAST_EXTERNAL_RELAY_NO_AUTH && !__RDNS_STATIC && (__RDNS_DYNAMIC_IPADDR || __RDNS_DYNAMIC_DHCP || __RDNS_DYNAMIC_HCC || __RDNS_DYNAMIC_ATTBI || __RDNS_DYNAMIC_ROGERS || __RDNS_DYNAMIC_ADELPHIA || __RDNS_DYNAMIC_DIALIN || __RDNS_DYNAMIC_HEXIP || __RDNS_DYNAMIC_SPLIT_IP || __RDNS_DYNAMIC_YAHOOBB || __RDNS_DYNAMIC_OOL || __RDNS_DYNAMIC_RR2   || __RDNS_DYNAMIC_COMCAST || __RDNS_DYNAMIC_TELIA || __RDNS_DYNAMIC_VTR || __RDNS_DYNAMIC_CHELLO_NO  || __RDNS_DYNAMIC_CHELLO_NL  || __RDNS_DYNAMIC_VELOX  || __RDNS_DYNAMIC_NTL  || __RDNS_DYNAMIC_TDS || __RDNS_DYNAMIC_VIRTUA || __RDNS_DYNAMIC_SPACELAN || __RDNS_INDICATOR_DYN || __RDNS_INDICATOR_RES || __RDNS_INDICATOR_TYPE2 || __RDNS_DYNAMIC_TTNET || __RDNS_DYNAMIC_ASAHI))
 208 describe RDNS_DYNAMIC Delivered to internal network by host with dynamic-looking rDNS
 209
 210 meta RDNS_NONE      (__RDNS_NONE && !__CGATE_RCVD && !__DOMINO_RCVD)
 211 describe RDNS_NONE  Delivered to internal network by a host with no rDNS
 212
 213