|
Related Topics
How the default rules.SubjectBlock file works
The rules.SubjectBlock file (located in the Internet Services/Filters folder on the administrator's Desktop) contains undesirable words and phrases that may be found in the "Subject" field of incoming mail. Internet Services uses SMTP mail rules (rules.MailRules) to set a spam score for this content, which you can then choose to block
before the mail message reaches your users, or tag to allow your users to handle it using their own end-user mail rules.
The rules.SubjectBlock file does not automatically block undesired content from your site unless you've "SubjectBlock causes NDN" on the Mail Rules subtab of the Basic Internet Setup form). Instead, if a word or phrase listed in your rules.SubjectBlock file exists anywhere in the "Subject" field of a message, Internet Services adds a value to the spam level, scores the message, and gives it the priority of Junk, if applicable. This process prevents accidental non-delivery of legitimate email and lets you control how to handle potential spam for your individual site.
The values and scores Internet Services assigns are based on the rules configured in the rules.MailRules file. For example, this rule
Subject: IF ($Form.Config.2605.Checkbox == 0 && @inblocklist($subject)) SET $spamlevel += 100 AND $spamtests += "SUBJECTBLOCK;"
checks to see if both the
• "Subject" field of a message contains any words that are in the rules.SubjectBlock list
and
• "SubjectBlock causes NDN" field checkbox on the Basic Internet Setup form/UCE/Spam/Mail Rules subtab, is deselected.
If both are tests are TRUE, the spam score is increased by 100.
How to add rules.SubjectBlock file entries
The format of the rules.SubjectBlock file is simple: one word or phrase per line. To add comments, preface the line with #. For example,
# these are silly words we want to block
Viagra
Free mortgages
Get rich
ADV:
 Note The @inblocklist function performs case insensitive comparisons by default. To perform case sensitive comparisons, use the optional "true" parameter: @inblocklist($subject, true)
After you've edited the file, close it to save your changes and click Reload Config on the Control tab of the Internet Services Monitor form.
You can create more extensive blocking lists that scan other fields in a message and also work with SMTP rules to score content accordingly (see, [Link]Defining your own blocking lists).
How the rules.MailRules file uses the rules.SubjectBlock file
The rules.MailRules file contains rules to test the content of the "Subject" field against undesirable words and phrases you've added to your rules.SubjectBlock file. The rules.MailRules file also contains rules to find tricks spammers use to hit sites.
You can add your own rules as required or disable any default rules by using # at the beginning of the line. For example:
# Subject: IF ($Form.Config.2605.Checkbox == 0 && @inblocklist($subject)) SET $spamlevel += 100 AND $spamtests += "SUBJECTBLOCK;"
Here are some entries in the default rules.MailRules file that Internet Services uses to test the "Subject" field of mail messages:
-----------------------
# Subject tests go here
• Subject: IF ($Form.Config.2605.Checkbox && @InBlockList($Subject)) NDN 550 "$sorry"
Checks if the subject contains any words in the rules.SubjectBlock list and checks if the "SubjectBlock causes NDN" checkbox, found on the Basic Internet Setup form, is selected. If both tests return TRUE, an NDN is sent.
• Subject: IF ($Form.Config.2605.Checkbox == 0 && @inblocklist($subject)) SET $spamlevel += 100 AND $spamtests += "SUBJECTBLOCK;"
Checks if the subject contains any words that are in the rules.SubjectBlock list and checks if the "SubjectBlock causes NDN" checkbox, found in the Basic Internet Setup form, is deselected. If both tests return TRUE, the
spam score is increased by 100.
• Subject: regexp:"^$" SET $spamlevel += 10 AND $spamtests += "SUBJ_HAS_NO_SUBJECT;"
Checks if the subject line is empty. Messages with no subjects have a greater chance of being spam. If TRUE, the spam score is increased by 10.
• Subject: " " SET $spamlevel += 20 AND $spamtests += "SUBJ_HAS_SPACES;"
Checks if the subject has extra spaces in it. Spammers sometimes use subjects such as "Hi... Remember me? <random number>", which would get caught by this check because of the extra spaces. If TRUE, the spam score is increased by 20.
• Subject: IF (@allcaps($subject)) SET $spamlevel += 25 AND $spamtests += "SUBJ_ALL_CAPS;"
Checks if the subject is written in all uppercase letters. Using all uppercase letters is usually an indication of spam, and the spam score will be increased by 25.
• Subject: eregexpi:"(^|[^[:alnum:]])(v|\\\\/)[^[:alnum:]]{0,2}[i1l\|!¡ÌÍÎÏìííîï][^[:alnum:]]{0,2}[a@ÀÁÂÃÄÅÆàáâãäå][^[:alnum:]]{0,2}g[^[:alnum:]]{0,2}r[^[:alnum:]]{0,2}[a@ÀÁÂÃÄÅÆàáâãäå]($|[^[:alnum:]])" SET $spamlevel += 101 AND $spamtests += "SUBJ_VIAGRA;"
• Subject: eregexpi:"x[^[:alnum:]]{0,2}[a@][^[:alnum:]]{0,2}n[^[:alnum:]]{0,2}[a@][^[:alnum:]]{0,2}x" SET $spamlevel += 101 AND $spamtests += "SUBJ_XANAX;"
• Subject: eregexpi:"d[^[:alnum:]]{0,2}r[^[:alnum:]]{0,2}u[^[:alnum:]]{0,2}g[^[:alnum:]]{0,2}s" SET $spamlevel += 100 AND $spamtests += "SUBJ_DRUGS;"
The preceding three tests, check for different variations of the words "Viagra", "Xanax" and "drugs" which are designed by spammers to bypass antispam filters but are recognizable to humans. If the test returns TRUE for either line 30 or 31, the spam score is increased by 101. If the test returns TRUE for line 32, the spam score is increased by 100.
• Subject: IF (@PunctCount($Subject) >= 5) SET $spamlevel += 10 AND $spamtests += "EXCESS_PUNCT;"
Checks if the subject contains five or more characters of punctuation. Excessive punctuation is sometimes an indication of spam. If this test returns TRUE, the spam score is increased by 10.
• Subject: IF (@WordCount("lists.Rude", $Subject) > 1) SET $spamlevel += 100 AND $spamtests += "SUBJ_RUDE_WORDS;"
Checks if the subject contains more than one word that is in the lists.Rude file found in the Filters folder. If this test returns TRUE, the spam score is increased by 100.
|
