OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: Rejecting emails with invalid/unlikely dates?

From: Darren Pilgrim (postfixbitfreak.org)
Date: Wed Dec 31 2008 - 15:36:53 CST


IBBoard wrote:
> I've been looking around but so far haven't been able to find anything
> (partly because it's difficult to phrase a search query!). If someone
> has a solution/config for this then that'd be great.
>
> Before anyone points out issues with GMail and lack of control, this is
> all being done on a domain on a VPS. I'm just using my Gmail address for
> the mailing list :)
>
> Basically, 99% of the spam I get (which is only a small amount compared
> to some people) is either a) purporting to be from me, to me or b) has a
> date that Thunderbird reports as 1976 or 2038 (but is really 3609 or
> just "38"). I've resolved the first part with SPF records and checking
> them in Postfix, but I can't work out how to get Postfix to reject mail
> that is outside a 14 day window from today (or silently dispose of it if
> it's not possible because it has to get too far in to the system to fail
> it).

You need a content filter for this. Header checks can do this; however,
they're static, so you have the problem of updating them constantly to
keep the validity window moving. Plus there's the issue of date
formats. The best way, IMO, is a policy service that can grok a wide
variety of date formats and check if the date is within 14 days of the
current time.

There are spamassassin rules for future dates in message headers, so you
might try that route instead of rolling your own.