forked from schampeo/EnemieslistM4
-
Notifications
You must be signed in to change notification settings - Fork 0
/
EL_Check_Headers.m4
139 lines (128 loc) · 5.1 KB
/
EL_Check_Headers.m4
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
divert(-1)dnl
#
# Copyright (c) 2004-2011 hesketh.com/inc. All rights reserved.
# See the file LICENSE in the distribution for details.
#
# questions? <[email protected]>
#
divert(0)dnl
VERSIONID(`$Id: EL_Check_Headers.m4,v 1.34 2011/05/13 22:13:18 schampeo Exp $')
divert(-1)dnl
LOCAL_CONFIG
#------------------------------------------------------------------------
# enemieslist.com miscellaneous header checks for headers only found in spam
#------------------------------------------------------------------------
HMS-OrigTo: $>EL_Check_Header_Exists
HMesg-ID: $>EL_Check_Header_Exists
HRecieved: $>EL_Check_Header_Exists
HReply_to: $>EL_Check_Header_Exists
HX-1: $>EL_Check_Header_Exists
HX-AmazingDeals4You-Userid: $>EL_Check_Header_Exists
HX-AR: $>EL_Check_Header_Exists
HX-AskVersion: $>EL_Check_Header_Exists
#HX-BBounce: $>EL_Check_Header_Exists
HX-BrCs: $>EL_Check_Header_Exists
HX-CS-IP: $>EL_Check_Header_Exists
#HX-Campaign: $>EL_Check_Header_Exists
HX-ChoiceMail-Registration-Request: $>EL_Check_Header_Exists
HX-ClientHost: $>EL_Check_Header_Exists
Hx-delete-me: $>EL_Check_Header_Exists
HX-Delivery: $>EL_Check_Header_Exists
HX-DTR5: $>EL_Check_Header_Exists
# also used by StrongMail (netflix et al.)
#HX-Destination-ID: $>EL_Check_Header_Exists
# possibly eMerge? SA no longer checks for this header
# probably "MailKing"
#HX-EM-Registration: $>EL_Check_Header_Exists
HX-ENVID: $>EL_Check_Header_Exists
HX-Find: $>EL_Check_Header_Exists
HX-GreatestDot-ID: $>EL_Check_Header_Exists
HX-happygoldlucky-MsgID: $>EL_Check_Header_Exists
HX-ICPINFO: $>EL_Check_Header_Exists
# x-identity-key seems to be Mozilla shorthand
#HX-Identity-Key: $>EL_Check_Header_Exists
HX-INFO_AZ: $>EL_Check_Header_Exists
HX-INFO_BZ: $>EL_Check_Header_Exists
HX-INFO_CZ: $>EL_Check_Header_Exists
HX-InsiderzEdge-ID: $>EL_Check_Header_Exists
HX-JLH: $>EL_Check_Header_Exists
HX-JM: $>EL_Check_Header_Exists
# apparently used by legitimate rewards program per CXC
#HX-Job: $>EL_Check_Header_Exists
HX-LCM: $>EL_Check_Header_Exists
HX-Mailid: $>EL_Check_Header_Exists
# used by Netflix in addition to hardcore spammers
#HX-MailingID: $>EL_Check_Header_Exists
# removed the next three 09/24/07 due to FPs
#HX-MailPersonEmail: $>EL_Check_Header_Exists
#HX-MailPersonHistoryID: $>EL_Check_Header_Exists
#HX-MailPersonSubscriberID: $>EL_Check_Header_Exists
HX-MailTransfer: $>EL_Check_Header_Exists
HX-Mid: $>EL_Check_Header_Is_A_Hash
HX-Moo: $>EL_Check_Header_Exists
HX-Nediorn: $>EL_Check_Header_Exists
HX-Nexttime: $>EL_Check_Header_Exists
HX-Nominal: $>EL_Check_Header_Exists
HX-RM: $>EL_Check_Header_Exists
ifdef(`_EL_REJECT_XROCKETDSI', `dnl
HX-RocketDSI: $>EL_Check_Header_Exists
')dnl
HX-Rot: $>EL_Check_Header_Exists
HX-SavingzBuy-ID: $>EL_Check_Header_Exists
HX-SavingzBuy-Userid: $>EL_Check_Header_Exists
HX-SavingzBuy-Recipient: $>EL_Check_Header_Exists
HX-Sendera: $>EL_Check_Header_Exists
HX-SP-Track-ID: $>EL_Check_Header_Exists
HX-Streamsendid: $>EL_Check_Header_Exists
HX-Strings-Info: $>EL_Check_Header_Exists
# used by t-online.de, apparently
#HX-TOI-MSGID: $>EL_Check_Header_Exists
HX-Transfer-Number: $>EL_Check_Header_Exists
HX-Transfer-Stamp: $>EL_Check_Header_Exists
# apparently, x-unsent does not mean anything
#HX-Unsent: $>EL_Check_Header_Exists
HX-Version-Info: $>EL_Check_Header_Exists
HX-WCMailID: $>EL_Check_Header_Exists
# used by thawte/rjs0.com
#HX-cid: $>EL_Check_Header_Exists
# used by eweek
#HX-eid: $>EL_Check_Header_Exists
HX-lid: $>EL_Check_Header_Exists
Hage-Info: $>EL_Check_Header_Exists
HX-USED-EQUIPMENT-REQUEST: $>EL_Check_Header_Exists
HX-Sp@mX: $>EL_Check_Header_Exists
# VC Sterling / emarketers
HX-VCM: $>EL_Check_Header_Exists
# checks for various stupid headers only inserted when the message is
# so garbled/mangled/malformed that it should have been rejected
HSun-ONE-SMTP-Warning: $>EL_Check_B0rkenRatware
# check for md5 style hash
KEL_IsAHash regex -a<MATCH> \=$
LOCAL_RULESETS
#------------------------------------------------------------------------
# enemieslist.com miscellaneous header checks for headers only found in spam
#------------------------------------------------------------------------
SEL_Check_Header_Exists
ifdef(`_EL_TRACE', `dnl
R$* $: $1 $(EL_Log "Exists w/ " $1 "; score: " $&{ELSuspiciousCount} "." $)
')dnl
# skip locally-originating mail
ifdef(`_EL_SKIPLOCAL', `dnl
R$* $: $1 $| $&{client_addr}
R$* $| 127.0.0.1 $@
')dnl
# check for whitelisted host
R$* $: $&{ELWhitelisted}
# now reject the message if it's not a whitelisted host
R$@ $#error $@ 5.7.1 $: ifdef(`confEL_ErrCheck_Headers', `confEL_ErrCheck_Headers', `"554 BADHEAD Contact "$&{ELContactEmail}" if this is in error, but your message was rejected as spam; it contains a suspicious header: " $&{hdr_name} "."')
SEL_Check_Header_Is_A_Hash
# skip locally-originating mail
ifdef(`_EL_SKIPLOCAL', `dnl
R$* $: $1 $| $&{client_addr}
R$* $| 127.0.0.1 $@
')dnl
# check for whitelisted host
R$* $: $&{ELWhitelisted}
# now reject the message if it seems to contain a tracking device
R$* $: $(EL_IsAHash $&{currHeader} $)
R<MATCH> $>EL_TagSuspicious <ifdef(`confEL_TagErrMsgTracker', `confEL_TagErrMsgTracker', `"header contains tracking device"')> $| 2