Blacklist from encoding

[Mark Martinec]

Luc,

> it is possible to set a mail as a spam according to its encoding ?
> Same question with sending country (GeoIP ?) ?

There are no direct provisions for this in amavisd, such decisions are
commonly delegated to SpamAssassin.

Here are some of my SA rules (in file local.cf) to contribute some
spam score points for character set encodings not normally seen
by our users except in spam:

header __L_CHARSET1  ALL =~ m{=\?(iso-8859-9|GB2312)\?}i
header __L_CHARSET2  ALL =~ m{\bwindows-1254}i
header __L_CHARSET3  Content-Type =~ m{\b(?:windows-1256|ISO-8859-6)\b}i
full   __L_CHARSET4  /^Content-Type:.*\bcharset=(?:windows-1256|ISO-8859-6)\b/mi
header __L_CHARSET5  Subject =~ m{\b(?:windows-1256|ISO-8859-6)\b}i
header __L_CHARSET6  From:raw =~ m{\b(?:windows-1256|ISO-8859-6)\b}i
meta   L_ARABIC   __L_CHARSET3 || __L_CHARSET4 || __L_CHARSET5 || __L_CHARSET6
score  L_ARABIC   3
meta   L_CHARSET  __L_CHARSET1 + __L_CHARSET2 + L_ARABIC >= 1
score  L_CHARSET  1.6

Regarding the GeoIP, there is some experimental SA plugin named RelayCountry2
which uses Geo::IP, but essentially achieves similar functionality as the
existing SA plugin RelayCountry, which uses an older IP::Country::Fast module.

There is also an amavisd custom hook using Geo::IP, which adds an information
header field about the country, but does not affect spam score. I guess it
can be modified to achieve more. See amavis-users archive around 2011-05,
subject: "amavisd plugin for the geolocation addresses and headers X-Anti-Abuse".

  Mark