zlacker

>>jgraha+(OP)
I would never use Cloudflare. They hide spammers and refuse to do anything about them. The same mass spammer will register site after site for months, sending snowshoe spam, and cloudflare refuses to do anything. At one point this was taking up about 80% of our incoming spam, and most of it was getting through spam filters due to the snowshoeing. You could see the same registration info for hundreds of domains over months, all sending spam, but cloudflare doesn't give a shit.

The only solution I found was to put a 15 minute delay on all incoming email from a cloudflare domain, then do a second check of the blacklists. This solved the problem, as the sending ips (not cloudflare) tended to get blacklisted within 15 minutes.

In my mind if you're hiding people's websites behind your "cloud", you have a responsibility to kick off the spammers.

>>cpncru+Zy1
How do you have your MTA check if a domain is hosted through Cloudflare, and what blacklists do you use? I think I'd like to do this, too.

>>johnkl+Az1
Code here:

https://pastebin.com/tgS58k6Q

>>cpncru+083
Why use a homebrew Perl script for this when Postfix (and likely most other MTAs) has features available that can do this for you?

Want to block all mail from any domain name that's hosted by Cloudflare? That's simple enough (and doesn't require taking a shower afterwards, unlike when writing Perl).

Just grab the plain-text version of the file that contains the list of Cloudflare's IP address ranges [0], create a CIDR table [1] containing those ranges (followed by a "REJECT"), and add an instance of "check_sender_a_access" to your "smtpd_sender_restrictions" [2].

(Bonus points for taking a couple of minutes to write a shell script that runs once per day from cron, grabs the latest version of this text file, adds " REJECT" to the end of each line for you, and triggers a reload of Postfix if there were any changes to the IP ranges that it needs to know about.)

[0]: https://www.cloudflare.com/ips-v4

[1]: http://www.postfix.org/cidr_table.5.html

[2]: http://www.postfix.org/postconf.5.html#smtpd_sender_restrict...