An update on Communicado

6 thoughts on “An update on Communicado”

1. Thanks for the DNS BL; I’ll give it a whirl with postfix-policyd.

   Reply

2. I don’t do #ff, but if you run a mail server, you definitely want to keep an eye on @excommunicado’s good work. See http://t.co/8Gikj9QTsu

   Reply

3. Here’s some quick and dirty perl for doing a lookup – it should be possible to wrap this into a plugin for spamassassin format.

   #!/usr/bin/perl

   use Net::DNS;

   $domain = @ARGV[0];
   my $res = Net::DNS::Resolver->new;

   lookup_hostname();
   is_it_a_spammer();

   sub lookup_hostname {

   $query = $res->query(“$domain”,”A”);

   if ($query) {
   foreach $rr ($query->answer) {
   next unless $rr->type eq “A”;

   our $ip = $rr->address;

   }
   }
   }

   sub is_it_a_spammer {

   if ( $ip =~ /127.0.0.2/ ){
   return 1;
   } else {
   return 0;
   }
   }

   I’ve been looking at the FromNotReplyTo plugin for inspiration and the from address is available via:

   my $from = lc($msg->get( ‘From:addr’ ));

   (whilst I’ve been using $ARGV[0] for testing), so plugging the sender domain back into $domain should be possible?

   Sorry for the unfinished state of this – I’m off home now 🙂

   Reply

4. Here we go – the finished SA plugin. Please excuse any little formatting quirks that might creep in by pasting it here!

   Excommunicado.cf
   —–

   loadplugin Excommunicado Excommunicado.pm
   header EXCOMMUNICADO eval:lookup_excommunicado()
   score EXCOMMUNICADO 5.0
   describe EXCOMMUNICADO Sender domain is listed as a Communicado spamming domain.

   —–

   Excommunicado.pm
   —–

   package Excommunicado;
   1;

   use strict;

   use Mail::SpamAssassin;
   use Mail::SpamAssassin::Plugin;
   our @ISA = qw(Mail::SpamAssassin::Plugin);

   use Net::DNS;

   sub new {
   my ($class, $mailsa) = @_;
   $class = ref($class) || $class;
   my $self = $class->SUPER::new( $mailsa );
   bless ($self, $class);
   $self->register_eval_rule ( ‘lookup_excommunicado’ );

   return $self;
   }

   sub lookup_excommunicado {
   my ($self, $pms) = @_;

   my %from_addrs = map { lc($_) => 1 } ($pms->all_from_addrs());
   delete $from_addrs{”}; # no empty ones thx

   foreach my $domain (keys %from_addrs) {

   $domain =~ s/.*@//;
   $domain = $domain . ‘.excommunicado.co.uk’;

   my $res = Net::DNS::Resolver->new;

   my $query = $res->query(“$domain”,”A”);

   if ($query) {
   foreach my $rr ($query->answer) {
   next unless $rr->type eq “A”;

   my $ip = $rr->address;

   if ( $ip =~ /127.0.0.2/ ){
   return 1;
   } else {
   return 0;
   }
   }
   }
   }
   }

   —–

   Reply
5. Pingback: spam (policyd-weight + excommunicado) | David Goodwin

6. Martin, firstly, thanks for a great service! These bitesize bastards need stopping. 🙂

   Does the RBL only respond to root domains – no subdomains/hosts? At the moment, I’m requesting lookups on whatever’s to the right hands side of “@” in the smtp reverse-path but I’m thinking this might need changing…

   Reply