X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=modules%2Fexim%2Ftemplates%2Feximconf.erb;h=6dc0a5960ce6e01ccf638a4b95a86c7e2445026e;hb=74228f95e562156c74e302c33d5c2692c0c31564;hp=7073f747513dc37bb0d4c649b9e7a1fafb77c541;hpb=972761e1dd6a6465190c3f63d88b3eec95a2020b;p=mirror%2Fdsa-puppet.git

diff --git a/modules/exim/templates/eximconf.erb b/modules/exim/templates/eximconf.erb
index 7073f7475..6dc0a5960 100644
--- a/modules/exim/templates/eximconf.erb
+++ b/modules/exim/templates/eximconf.erb
@@ -450,14 +450,17 @@ check_helo:
   # These are in HELO acl so that they are only run once.  They increment a counter,
   # so we don't want it to increment per rcpt to.
 
+  # high trust
   warn    dnslists       = list.dnswl.org&0.0.0.3
           log_message    = Hit on list.dnswl.org for $sender_host_address
           set acl_c_scr  = ${eval:$acl_c_scr-30}
 
+  # >= medium trust
   warn    dnslists       = list.dnswl.org&0.0.0.2
           log_message    = Hit on list.dnswl.org for $sender_host_address
           set acl_c_scr  = ${eval:$acl_c_scr-20}
 
+  # any form of listing
   warn    dnslists       = list.dnswl.org
           log_message    = Hit on list.dnswl.org for $sender_host_address
           set acl_c_scr  = ${eval:$acl_c_scr-10}
@@ -470,15 +473,18 @@ check_helo:
           condition      = ${if eq{$host_lookup_failed}{1}}
           set acl_c_scr  = ${eval:$acl_c_scr+20}
 
+  # HELO looks like a dynamic address (with RDNS match)
   warn    !hosts         = +debianhosts
           condition      = ${if eq{$host_lookup_failed}{0}}
           condition      = ${if match{$sender_host_name}{\N(^[^\.]*[0-9]\-+[0-9]|^[^\.]*[0-9]{5,}[^\.]|^([^\.]+\.)?[0-9][^ \.]*\.[^\.]+\..+\.[a-z]|^[^\.]*[0-9]\.[^\.]*[0-9]-[0-9]|^(dyn|cable|dhcp|dialup|ppp|adsl)[^\.]*[0-9])\N}}
           set acl_c_scr  = ${eval:$acl_c_scr+20}
 
+  # HELO looks like a dynamic address
   warn    !hosts         = +debianhosts
           condition      = ${if match{$sender_helo_name}{\N(^[^\.]*[0-9]\-+[0-9]|^[^\.]*[0-9]{5,}[^\.]|^([^\.]+\.)?[0-9][^ \.]*\.[^\.]+\..+\.[a-z]|^[^\.]*[0-9]\.[^\.]*[0-9]-[0-9]|^(dyn|cable|dhcp|dialup|ppp|adsl)[^\.]*[0-9])\N}}
           set acl_c_scr  = ${eval:$acl_c_scr+20}
 
+  # mail from a dynamic IP address range
   warn    !hosts         = +debianhosts
           dnslists       = dul.dnsbl.sorbs.net
           set acl_c_scr  = ${eval:$acl_c_scr+15}
@@ -857,6 +863,11 @@ check_recipient:
 	  domains       = +handled_domains
 	  !hosts        = +debianhosts : WHITELIST
 
+  deny    message  = host $sender_host_address is listed in $dnslist_domain; see $dnslist_text
+          dnslists = noserver.dnsbl.sorbs.net
+          domains  = +handled_domains
+          !hosts   = +debianhosts : WHITELIST
+
 <%- end -%>
   deny    message  = domain $sender_address_domain is listed in $dnslist_domain; see $dnslist_text
           dnslists = ${if match_domain{$domain}{+virtual_domains}\
@@ -867,6 +878,11 @@ check_recipient:
 	  domains       = +handled_domains
 	  !hosts        = +debianhosts : WHITELIST
 
+  deny    message  = domain $sender_address_domain is listed in $dnslist_domain; see $dnslist_text
+          dnslists = nomail.rhsbl.sorbs.net/$sender_address_domain
+          domains  = +handled_domains
+          !hosts   = +debianhosts : WHITELIST
+
 <%- unless @use_smarthost -%>
   deny    domains  = +handled_domains
           local_parts = ${if match_domain{$domain}{+virtual_domains}\