[milter] # the directory with persistent data files datadir = /var/lib/milter logdir = /var/log/milter # the socket used to communicate with sendmail. Must match sendmail.cf socket=/var/run/milter/pythonsock # where to save original copies of defanged and failed messages tempdir = /var/log/milter/save # how long to wait for a response from sendmail before giving up ;timeout=600 log_headers = 0 # Connection ips and hostnames are matched against this glob style list # to recognize internal senders. You probably need to change this. # The default is a good guess to try and prevent newbie frustration. internal_connect =,127.* # mail that is not an internal_connect and claims to be from an # internal domain is rejected. Furthermore, internal mail that # does not claim to be from an internal domain is rejected. # You should enable SPF instead if you can. SPF is much more comprehensive and # flexible. However, SPF is not currently checked for outgoing # (internal_connect) mail because it doesn't yet handle authorizing # internal IPs locally. ;internal_domains = mycorp.com,localhost.localdomain # connections from a trusted relay can trust the first Received header # SPF checks are bypassed for internal connections and trusted relays. ;trusted_relay =, # Relaying to these domains is allowed from internal connections only. # You might want to restrict aol.com, for instance, so that stupid # users don't forward their spam to aol for filtering and get your MTA # blacklisted by aol. ;private_relay = aol.com, yahoo.com # If this is defined, internal connections not in this list are # not allowed to send DSNs (empty MAIL FROM). We could check that # a purported MTA accepts connections on port 25, but that could be # time consuming with firewalls typically discarding rather than rejecting. ;internal_mta = # Reject external senders with hello names no legit external sender would use. # SPF will do this also, but listing your own domain and mailserver here # will save some DNS lookups when rejecting certain viruses, and the # connect IP is banned. ;hello_blacklist = mycorp.com, # Reject mail for domains mentioned unless user is mentioned here also ;check_user = joe@mycorp.com, mary@mycorp.com, file:bigcorp.com # Treat localparts in milter.cfg as case-sensitive. Set to false to handle # mailers that violate RFCs by failing to preserve case. (And make # sure sendmail is configured to ignore case.) case_sensitive_localpart = true # Various nasty MTA behaviours get demerits. When they reach this limit # on a single connection, the IP is banned. Leave unset for # "unlimited" (actually 2**31-1). I use 3. ;max_demerits = 3 # When a domain in this list would get banned, the specific mailbox # is banned instead. These free email providers have a "whack-a-mole" problem. email_providers = yahoo.com, gmail.com, aol.com, hotmail.com, me.com, googlegroups.com, att.net # features intended to filter or block incoming mail [defang] # do virus scanning on attached messages also scan_rfc822 = 0 # do virus scanning on attached zipfiles also scan_zip = 0 # Comment out scripts in HTML attachments. Can be CPU intensive. scan_html = 0 # reject messages with asian fonts because we can't read them block_chinese = 0 # list users who hate forwarded mail ;block_forward = egghead@mycorp.com, busybee@mycorp.com # reject mail with these case insensitive strings in the subject porn_words = penis, pussy, horse cock, porn, xenical, diet pill, d1ck, vi*gra, vi-a-gra, viag, tits, p0rn, hunza, horny, sexy, c0ck, xanaax, p-e-n-i-s, hydrocodone, vicodin, xanax, vicod1n, x@nax, diazepam, v1@gra, xan@x, cialis, ci@lis, frëe, xănax, valíum, vălium, via-gra, x@n3x, vicod3n, penís, c0d1n, phentermine, en1arge, dip1oma, v1codin, valium, rolex, sexual, fuck, adv1t, vgaira, medz, acai berry # reject mail with these case sensitive strings in the subject spam_words = $$$, !!!, XXX, HGH # Experimental: Reject mail with these case sensitive strings in the human # readable part of the From header field. Also, ban the domain if it gets # a pass from SPF or best_guess and is a "new" domain according to # pygossip. This helps generate a list of "throwaway" spam domains. ;from_words = Stimulus, Diabetes, Trivia, Age Quiz, Detox, White Teeth # attachments with these extensions will be replaced with a warning # message. A copy of the original will be saved. banned_exts = ade,adp,asd,asx,asp,bas,bat,chm,cmd,com,cpl,crt,dll,exe,hlp,hta, inf,ins,isp,js,jse,lnk,mdb,mde,msc,msi,msp,mst,ocx,pcd,pif,reg,scr,sct, shs,url,vb,vbe,vbs,wsc,wsf,wsh # See http://bmsi.com/python/pysrs.html for details [srs] config=/etc/mail/pysrs.cfg # SRS options can be set here also, but must match the sendmail plugin ;secret="shhhh!" ;maxage=21 ;hashlength=4 ;database=/var/log/milter/srsdata ;fwdomain = mydomain.com # turn this on after a grace period to reject spoofed DSNs reject_spoofed = 0 # Many braindead MTAs send DSNs with a non-DSN MFROM (e.g. to report that # some virus claiming to be sent by you). This heuristic # refuses mail from user names commonly abused in that way. ;banned_users = postmaster, mailer-daemon, clamav # See http://www.openspf.com for more info on SPF. [spf] # namespace where SPF records can be supplied for domains without one # records are searched for under _spf.domain.com ;delegate = domain.com # domains where a neutral SPF result should cause mail to be rejected ;reject_neutral = aol.com # use a default (v=spf1 a/24 mx/24 ptr) when no SPF records are published ;best_guess = 0 # Reject senders that have neither PTR nor valid HELO nor SPF records, or send # DSN otherwise ;reject_noptr = 0 # always accept softfail from these domains, or send DSN otherwise ;accept_softfail = bounces.amazon.com # Treat fail from these domains like softfail: because their SPF record # or an important sender is screwed up. Must have valid HELO, however. ;accept_fail = custhelp.com # Use sendmail access map or similar format for detailed spf policy. # SPF entries in the access map will override any defaults set above. # Uncomment to activate. ;access_file = /etc/mail/access.db # Add MAIL FROM as Sender when Sender is missing and From domain # doesn't match MAIL FROM. Outlook and other email clients will then display # something like: "Sent by sender@domain.com on behalf of from@example.com" ;supply_sender = 0 # Connections that get an SPF pass for a pretend MAIL FROM of # postmaster@sometrustedforwarder.com skip SPF checks for the real MAIL FROM. # This is for non-SRS forwarders. It is a simple implementation that # is inefficient for more than a few entries. ;trusted_forwarder = careerbuilder.com # features intended to clean up outgoing mail [scrub] # domains that block visible private nodes ;hide_path = jcpenney.com # reject, don't just replace with warning, viruses from these domains ;reject_virus_from = mycorp.com # Apply SPF-Pass policy to internal mail, to check CBV, for instance. ;internal_policy = false # features intended for spying on users and coworkers [wiretap] blind = 1 # # wiretap lets you surreptitiously monitor a users outgoing email # (sendmail aliases let you monitor incoming mail) # ;users = disloyal@bigcorp.com, bigmouth@bigcorp.com # multiple destinations can use smart_alias ;dest = spy@bigcorp.com # discard outgoing mail without alerting sender # can be used in conjunction with wiretap to censor outgoing mail ;discard = canned@bigcorp.com # archive copies all delivered mail to a file ;mail_archive = /var/log/mail_archive # # smart aliases trigger on both sender and recipient # alias = sender, recipient[, destination] # [smart_alias] # multiple wiretap monitors. Smart aliases are applied after wiretap. ;spy1 = disloyal@bigcorp.com,spy@bigcorp.com ;spy2 = bigmouth@bigcorp.com,spy@bigcorp.com # mail from client@clientcorp.com to sue@bigcorp.com is redirected to # local alias copycust ;copycust = client@clientcorp.com,sue@bigcorp.com # mail from cust@othercorp.com to walter@bigcorp.com is redirected to # boss@bigcorp.com ;walter = cust@othercorp.com,walter@bigcorp.com,boss@bigcorp.com # additional copies can be added ;walter1 = cust@othercorp.com,walter@bigcorp.com,boss@bigcorp.com, ; walter@bigcorp.com ;bulk = soruce@telex.com,bob@bigcorp.com ;bulk1 = soruce@telex.com,larry@bigcorp.com,bulk # See http://bmsi.com/python/dspam.html [dspam] # Select a well moderated dspam dictionary to reject spammy headers. # To filter on the entire message, use the full setup below. # only EXTERNAL messages are dspam filtered ;dspam_dict=/var/lib/dspam/moderator.dict # Recipients of mail sent from these senders are added to the auto_whitelist. # Auto_whitelisted senders with an SPF PASS are never rejected by dspam, and # messages from auto_whitelisted senders will be used to train screener # dictionaries as innocent mail. ;whitelist_senders = @mycorp.com # Also send auto_whitelist recipients to these MXes. This is not currently # parallelized, so list just one, or at most two. ;whitelist_mx = mail.mycorp.com,mail2.mycorp.com # Opt-out recipients entirely from dspam screening and header triage ;dspam_exempt=getitall@mycorp.com # Do not scan mail (ostensibly) from these senders ;dspam_whitelist=getitall@sender.com # Reject spam to these domains instead of quarantining it. ;dspam_reject=othercorp.com # Scan internal mail - often a good source of stats on legit mail. ;dspam_internal=1 # directory for dspam user quarantine, signature db, and dictionaries # defining this activates the dspam application # dspam and dspam-python must be installed ;dspam_userdir=/var/lib/dspam # do not dspam messages larger than this ;dspam_sizelimit=180000 # Map email addresses and aliases to dspam users ;dspam_users=david,goliath,spam,falsepositive # List dspam users which train on all delivered messages, as opposed to # "train on error" which trains only when a spam or falsepositive is reported. # Training mode will build the dictionary faster, but requires close attention # so as not to miss any spam or false positives. ;dspam_train=goliath ;david=david@foocorp.com,david.yelnetz@foocorp.com,david@bar.foocorp.com ;goliath=giant@foocorp.com,goliath.philistine@foocorp.com # address to forward spam to. milter will process these and not deliver ;spam=spam@foocorp.com # Spam forwarded to bandom will ban the domain after training as spam. # This helps deal with "throw-away" domains. The ban1 localpart # uses a wildcard for the first part of the banned domain, so that # instead of banning mx2.spammer.com, it bans *.spammer.com. # See email_providers above. ;bandom=bandom@mail.example.com,ban1@mail.example.com # address to forward false positives to. milter will process and not deliver ;falsepositive=ham@foocorp.com # account which receives only spam: all received messages are marked as spam. ;honeypot=spam-me@example.com # the dspam_screener is a list of dspam users who screen mail for all # recipients who are not dspam_users. Spam goes to the screeners quarantine, # and the original recipients are saved so that false positives can be properly # delivered. ;dspam_screener=david,goliath # The dspam CGI can also be used: logins must match dspam users # Optional pygossip interface # # GOSSiP tracks reputation of domain:qualifier pairs. For instance, # the reputation of example.com:SPF is tracked separately from # example.com:neutral. Currently qualifiers are # SPF,neutral,softfail,fail,permerror,GUESS,HELO [gossip] # Use a dedicated GOSSiP server. If not specified, a local database # will be used. ;server=host:11900 # To include peers of a peer in reputation, set ttl=2 ;ttl=1 # If a local database is used, also consult these GOSSiP servers about # domains. Peer reputation is also tracked as to how often they # agree with us, and weighted accordingly. ;peers=host1:port,host2 [greylist] dbfile=greylist.db # mins (Google retries in 5 mins) time=5 # hours (some legit sites don't retry for 6 hours) expire=6 # days (keep "first monday" type mailings on file) retain=36 [dkim] privkey = dkim_rsa ;domain = example.com ;selector = default