How block domains that uses amazones in "Filter Incoming Emails by Domain"

Secmas

January 14, 2021 11:52

Comments

10 comments

cPRex Jurassic Moderator

January 14, 2021 18:25
Hey there! In that interface you can't enter anything before the wildcard. You can try just using *='.@us-east-2.amazonses.com'>.us-east-2.amazonses.com on that page and that will work well. Can you try that instead?
0
Secmas

January 14, 2021 19:18
@cPRex Thank you for answering back. I know I can do that but I didn't want to go for that option as I don't know if legit users from amazones are using that email server. Instead I have created an SpamAssassin rule that is blocking that account, but I really like how the cPanel plugin works as it is a EXIM step while SpamAssassin is not. Any idea why the cPanel app didn't block the domain that appears under the From: header as well? That will be great.
0
cPRex Jurassic Moderator

January 14, 2021 19:29
I'm not completely sure what your last sentence means with regards to the From header settings. Can you get me more details on that?
0
Secmas

January 15, 2021 00:33
Sure, when I check the emails that enters into my servers, I can see the headers of the emails. Per example, using the same info about what we are talking (I have modified some info): Received: from e226-3.smtp-out.us-east-2.amazonses.com ([23.251.226.3]:41197) by server.myserver.com with esmtps (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (Exim 4.93) (envelope-from <010f01770344955b-21f50095-f523-4f56-856d-xxxxxxxxx-yyyyyyyyy@us-east-2.amazonses.com>) Date: Thu, 14 Jan 2021 23:39:22 +0000 To: myuser@userdomain.com From: ENCO Reply-To: ENCO Subject: =?UTF-8?Q?[Conecta_con_m=C3=A1s_clientes_desde_la_palma_de_tu_mano]?=
So, if you see the "From:" it shows the domain name that I want to block and that I have written into "Filter Incoming Emails by Domain" but it never gets blocked. I assume that cPanel addon looks for the "evelope-from:" section of the email instead of looking into the "From:" header. It will be great that "Filter Incoming Emails by Domain" could check for both, the envelope-from and the From: to block what we want.
0
cPRex Jurassic Moderator

January 15, 2021 13:26
That sounds like a good feature request :D For more advanced filter rules that let you choose what you block, you can do it in the account level through the Global Filers tool in cPanel, but there isn't an equivalent tool at the WHM level.
0
Secmas

January 15, 2021 14:19
Well, for now I have just wrote my own SpamAssassin rule that is global and it is working, but it is easier to add domains to the WHM plugin. Hope cPanel could check on this. Regards, Sergio
0
cPRex Jurassic Moderator

January 15, 2021 14:28
It would be best to use the link in my signature to submit a feature request, as our development team approves those and it will also let other cPanel users vote on it.
0
Secmas

January 15, 2021 15:41
Ok, doing it now. Thanks.
0
keat63

January 15, 2021 16:41
If you can't get any of the above suggestions to work for any reason, this has been discussed on the CSF forum.
0
Secmas

January 15, 2021 17:41
Thank you, @keat63. That thread in ConfigServer is mine, I am the one that started that thread and wrote some of my rules in there. What I am asking here is a little bit different. As you know emails have a few steps when entering into the server, the First Step is mostly managed by EXIM and the fastest way to block spammers is to manage the spammer IPs in the /etc/spammeripblocks, that blocks right in the act the emails sent by the IPs that are in there. It also will block IPs that are in Barracuda, SpamCop or any other Black List that you have set in there. Then, if the IP is not in there, the next steps will follow. One of the steps is to check the list of domains that the cPanel plugin saves at /etc/blocked_incoming_email_domains, so it doesn't require to much time from server than checking on the list if the domain is blocked there. If the email is not blocked by EXIM, then the email will be checked by SpamAssassin rules and then any other option that you write as the REGEX rules. In the case that I am asking, using a REGEX is out of option, as the REGEX will block the IP in the firewall and I don't want to block AMAZONES IPs, what I want is to block the offending domain. Sorry if I extended a bit my reply :)
0

Please sign in to leave a comment.

Comments

Didn't find what you were looking for?