Spam von (neuen) TLDs, hier "wnc89.win" und "tkdgy.trade"

[Postfix]

Hendl Stephan – Mon., 21. März 2016 15:19
> Hallo,
>
>
>  
> wir beobachten trotz aktuellem spamassassin-3.4, policyd-weight,  
> greylisting und diversen postfix-Regeln ein erhöhtes Spamaufkommen  
> von neuen TLDs. Diese Mails bekommen in der Regel aber nur 2.5  
> Spampunkte.
>
>
>  
> Mar 21 08:41:03 mailserver amavis[14171]: (14171-01) spam-tag,  
> <BOUNCE_PREFIX-1458511967.16104.kwucvgOVo8XW at wnc89.win> ->  
> <name at meinedomain.de>, No, score=2.5 tagged_above=-9999  
> required=6.31 tests=[BAYES_00=-1.9, RCVD_IN_PSBL=2.7,  
> URIBL_BLACK=1.7] autolearn=no
>
>
>  
> Ich könnte hier eine eigene Regel für „@wnc89.win“ aufstellen und  
> schon mal gleich 5 Punkte vergeben, das artet bei mehrere Domains  
> dann aber ganz schön aus… Hat jemand eine generische Idee?
>
>
>  
> Viele Grüße
>
> Stephan
>
>
>
Hallo Stephan,
ich lehne Mails von solchen Domains grundsätzlich ab. Da kommt derzeit  
wirklich nichts gescheites.
cat /etc/postfix/sender_access.regexp
/\.xyz$/           REJECT Mail from .xyz not accepted
/\.pw$/            REJECT Mail from .pw not accepted
/\.hk$/            REJECT Mail from .hk not accepted
/\.club$/          REJECT Mail from .club not accepted
/\.space$/         REJECT Mail from .space not accepted
/\.click$/         REJECT Mail from .click not accepted
/\.faith$/         REJECT Mail from .faith not accepted
/\.link$/          REJECT Mail from .link not accepted
/\.review$/        REJECT Mail from .review not accepted
/\.rocks$/         REJECT Mail from .rocks not accepted
/\.site$/          REJECT Mail from .site not accepted
/\.top$/           REJECT Mail from .top not accepted
/\.work$/          REJECT Mail from .work not accepted
/\.black$/         REJECT Mail from .black not accepted
/\.blue$/          REJECT Mail from .blue not accepted
/\.fyi$/           REJECT Mail from .fyi not accepted
/\.love$/          REJECT Mail from .love not accepted
/\.pro$/           REJECT Mail from .pro not accepted
/\.website$/       REJECT Mail from .website not accepted
/\.bid$/           REJECT Mail from .bid not accepted
/\.win$/           REJECT Mail from .win not accepted
/\.racing$/        REJECT Mail from .racing not accepted
/\.accountant$/    REJECT Mail from .accountant not accepted

grep sender_access.regexp  /etc/postfix/main.cf
smtpd_sender_restrictions = regexp:/etc/postfix/sender_access.regexp

Gruß
Andreas