How to use content filtering and wildcards to detect spam from this domain...

Question asked by Michael Robinson - 12/11/2017 at 10:11 AM

Answered

I'm having trouble getting content filtering in Smartmail 16 to pull out certain domains. I think I am not using the wildcards correctly. Can anyone help?

Here is an example:

email address = designer.sunglass.deals@silky.quety.win

I would like to filter everything containing ".win" after the @ because I am getting 100 emails per day from .win and they are all spam.

I have tried these but they do not work:

*.win

*@*.*.win

I have it set to allow wildcards and any condition must be met since I am running two conditions.

16 Replies

Reply to Thread

Scarab Replied

12/11/2017 at 12:00 PM

Marked As Answer

Here is how to do this using Custom Rules in SmarterMail with RegEx:

Rule Name: .win domain

Rule Source: Header

Header: Return-Path (you can use the From but Return-Path works best as many times the From is spoofed. It is *VERY* important not to use the trailing colon in this field!)

Rule Source: Regular Expression

Rule Text: .+\.win>$ (It is important to include the trailing angled bracket otherwise it won't work)

Weight: Depends on your scoring system. If using a 10/20/30 set it at 20.

Match Multiple: Off

Enable Spool Filtering: On

Enable Outgoing Spool Filtering: Optional

This rule will work for both example1@domain.win and example2@subdomain.domain.win.

Patrick Mattson Replied

12/11/2017 at 1:54 PM

Can you add multiple rules to block different domains, one per line, or does the expression take that as something an "and" or "or". For example, I sometimes see Spam from .bid and .xyz. I would like to make one rule. I figured out how to do this in Spamassassin, but not in SmarterMail.

Scarab Replied

12/11/2017 at 2:18 PM

Patrick,

Yes, you can add multiple domains in the Rules Text field (one per line). It assumes "OR" so you would not add that. So, you would just set your Rule Text to something like:

.+\.bid>$
.+\.top>$
.+\.xyz>$
.+\.win>$
.+\.work>$
.+\.zip>$

Michael Robinson Replied

12/11/2017 at 3:43 PM

Dumb question. Where do I set up custom rules?
Cant seem to find it when logged in as domain mgr

Michael Robinson Replied

12/11/2017 at 4:09 PM

where do you do add custom rules within smartermail 16 ?

I cant seem to find it

thx

Michael

Scarab Replied

12/11/2017 at 4:12 PM

To add a new Custom Rule in SM16 it is under SETTINGS > ANTISPAM > SPAM CHECKS and click on the [NEW] button.

Employee Replied

12/11/2017 at 4:14 PM

Employee Post

Custom spam checks can be created by logging in as the System Admin and going to Settings > Antispam > Spam Checks tab. Click New, and you can enter the settings Scarab posted above.

Michael Robinson Replied

12/11/2017 at 4:26 PM

thank you - I've set it up, now wait and see

many thanks

Michael Robinson Replied

12/11/2017 at 5:43 PM

it's working thank you

Michael Robinson Replied

12/11/2017 at 5:43 PM

it's working thank you for your help

Curtis Kropar www.HawaiianHope.org Replied

12/11/2017 at 6:50 PM

Michael,

You may also want to look at these

https://portal.smartertools.com/community/a861/smtp-blocking-ehlo-domain.aspx

https://portal.smartertools.com/community/a88213/blocking-domains-in-ehlo-domain-rule.aspx

www.HawaiianHope.org - Providing technology services to non profit organizations, low income families, homeless shelters, clean and sober houses and prisoner reentry programs. Since 2015, We have refurbished over 11,000 Computers !

Curtis Kropar www.HawaiianHope.org Replied

12/11/2017 at 6:52 PM

Scarab

So does this for SM 16 just filter it as spam or does it prevent it from being processed in the first place ?

Matt Petty Replied

12/12/2017 at 10:18 AM

Employee Post

It stops dead in the tracks at the SMTP level. It will throw an SMTP error and close the session.

Matt Petty Senior Software Developer SmarterTools Inc. www.smartertools.com

Curtis Kropar www.HawaiianHope.org Replied

12/12/2017 at 4:05 PM

Thanks Matt ! So what Scarab described here is a custom rule for SMTP, not just spam filtering. So this is the implementation of what Scarab described / requested in the first link i posted ?

https://portal.smartertools.com/community/a861/smtp-blocking-ehlo-domain.aspx

It is still marked as "Under Consideration"