filterconf(5)

NAME
filterconf - user configuration of SMTP level filtering

DESCRIPTION
The users may configure a bunch of filter rules. There are two kinds of settings: settings configured by a config directive in the file "filterconf" or settings configured by it's own file. The first are descriped in this man page, the latter are documented in Qsmtp(8). If the setting is not configured in the user directrory Qsmtpd will take the value from the domain directory. If there is no domain setting also the global one is taken if the setting is marked "global".

SYNTAX
These settings can occur in the file filterconf in the user or domain directory. Settings marked global can also occur in the global file /var/qmail/control/filterconf. There may be comments or empty lines in the filterconf file, both will be ignored. There are two kinds of settings, boolean and integer. If there is a boolean setting "foo" and there is a line containing just "foo" foo will be enabled. If there is no foo it will be disabled. Integer settings are "key=value", e.g. "foo=2" will set foo to 2. Neither characters between the key, the '=' and the value nor characters behind the value are permitted. Boolean expressions may be written as integers, "foo" as a boolean is the same as "foo=1" and "foo=123877", no "foo" line in the file is the same like "foo=0". There is a special value "-1" which means that if the user sets "foo=-1" foo will be disabled and the domain config will not be used.

KEYS

forcestarttls
    Recipient only accepts mail if the transmission is SSL-encrypted. Use this with care, this violates RfC 3207 and is only for the really paranoid users.

whitelistauth
    (global) If the user is authenticated by SMTP AUTH or by TLS client certificate the mail is accepted and no other filters will be checked.

check_strict_rfc2822
    The mail body is checked for compliance to RfC 2822. The mail is rejected if the mail is invalid. If only one of the recipients does not enable this check the mail will not be rejected. This is due to the fact that the mail must be completely transferred before it can be rejected but then only one reply code for all recipients can be returned. The checks performed on the header of the mail are:

    •   there must be exaclty one From: line

    •   there must be exaclty one Date: line

    •   there must be exaclty one Message-Id: line

    •   there must be no 8 bit characters in the header

fromdomain
    (global) Do some checks to the domain of the "MAIL FROM:" address. The value is a bitwise OR of these bits and stored as one integer number.

    bit 1
        reject mail if from domain does not exist (dns query returns NXDOMAIN)

    bit 2
        reject mail if from domain resolves only to localhost addresses (i.e. something in 127.0.0.0/8 or 0.0.0.0/32 for IPv4 or ::1 for IPv6)

    bit 3
        reject mail if from domain resolves only to private nets (RfC 1918)

reject_ipv6only
    (global) Reject if all MX records of the "MAIL FROM:" domain point to real IPv6 addresses. This is useful only on an IPv4 only node where this addresses can't be routed.

spfpolicy
    (global) Filter mail by the policy given by a DNS TXT record of the sender domain. The value has this meanings:

    1:  temporary DNS errors will block mail temporary

    2:  reject mail if the SPF record says 'fail'

    3:  reject mail if the SPF record is syntactically invalid

    4:  reject mail when the SPF record says 'softfail'

    5:  reject mail when the SPF record says 'neutral'

    6:  rejects mail when no SPF records are found see also: rspf (file), spfstrict (file), spfignore (file) in Qsmtpd(8)

nobounce
    Don't accept bounce messages to this recipients. This is useful if this address is never used to send mail (e.g. contact addresses on websites) to avoid backscatter of worms and viruses. Never use this if the mail is used for sending mail.

usersize
    The maximum size of a message the user wants to accept. This only works if the client uses ESMTP SIZE (which most real mailservers do). The wide spread worms with own SMTP engines don't use this so this will not block them.

block_SoberG
    (global) Block a mail where the combination of HELO and MAIL FROM looks like SoberG: MAIL FROM:<foo@example.com> would lead to HELO foo.com

helovalid
    (global) Mails with invalid helo are rejected. The value is a bitwise OR of these bits and stored as one integer number:

    bit 1
        helo is "my name"

    bit 2
        helo is "[ my IP address ]"

    bit 3
        helo is syntactically invalid (e.g. contains invalid characters, is neither a full qualified domain name nor an address literal)

    bit 4
        currently unused

    bit 5
        helo is my IP address, but not enclosed in '[]'. This is invalid and more or less a combination of 2 and 3

    all other bits:
        currently unused

block_wildcardns
    If the top level domain uses wildcard entries in their nameserver for nonexisting domains (e.g. museum does this) then this will deny such mails if the top level domain of the sender address and the MX (typically implicit A) match one entry in control/wildcardns.

smtp_space_bug
    (global) If the mail sender has a broken SMTP engine that inserts spaces at places not permitted by RfC 2822 the mail will get rejected. The following values are supported:

    0:  permit these SMTP engines

    1:  permit if the sender uses ESMTP

    2:  permit if the sender uses STARTTLS or is authenticated

    3:  permit if the sender is authenticated

    255:
        rejects all mails from those senders

fail_hard_on_temp
    If any filter returns with a temporary reject (e.g. sending IP is listed in a IP blacklist) a permanent failure is announced instead of the temporary one.

nonexist_on_block
    If any filter returns with a reject code the mail server will lie and tell the client the user does not exist instead of returning a policy error.

EXAMPLES
This is a suggested filterconf configuration file that has few false positives, but still considerably reduces the amount of incoming junk mails.
    whitelistauth
    helovalid=18
    fromdomain=7
    smtp_space_bug=1

SEE ALSO
Qsmtpd(8)

AUTHOR
Rolf Eike Beer

WEBSITE
https://opensource.sf-tec.de/Qsmtp/