Header IPs & IP to Country
Posted: 07 Jun 2023, 00:44
Hello,
In the past I've used the RelayCountry plugin in Spamassassin to create rulesets in our custom.cf to score certain countries higher when email has passed through servers within that country. Here's an example of the config from the Apache Wiki:
header RELAYCOUNTRY_BAD X-Relay-Countries =~ /CN/
describe RELAYCOUNTRY_BAD Relayed through China at some point
scoreRELAYCOUNTRY_BAD 3.0
header RELAYCOUNTRY_GOOD X-Relay-Countries =~ /^(FI|SE)/
describe RELAYCOUNTRY_GOOD First untrusted relay is Finland or Sweden :-)
score RELAYCOUNTRY_GOOD -0.2
I can see that when I view an email within the Front End of Mailscanner v9.23 that there's a section "Header IPs" and then a list of the IPs that the email travelled by way of, and importantly for me, the country of that IP.
Is there a way to access/utilise the reported 'country' in order to score email within the Mailscanner configuration somewhere or would I still need to go down the road of installing the GeoIP module and the Spamassassin "RelayCountryPlugin"? Seems that Mailscanner is already querying the IPs and producing the results required to create a rule.
Thanks!
In the past I've used the RelayCountry plugin in Spamassassin to create rulesets in our custom.cf to score certain countries higher when email has passed through servers within that country. Here's an example of the config from the Apache Wiki:
header RELAYCOUNTRY_BAD X-Relay-Countries =~ /CN/
describe RELAYCOUNTRY_BAD Relayed through China at some point
scoreRELAYCOUNTRY_BAD 3.0
header RELAYCOUNTRY_GOOD X-Relay-Countries =~ /^(FI|SE)/
describe RELAYCOUNTRY_GOOD First untrusted relay is Finland or Sweden :-)
score RELAYCOUNTRY_GOOD -0.2
I can see that when I view an email within the Front End of Mailscanner v9.23 that there's a section "Header IPs" and then a list of the IPs that the email travelled by way of, and importantly for me, the country of that IP.
Is there a way to access/utilise the reported 'country' in order to score email within the Mailscanner configuration somewhere or would I still need to go down the road of installing the GeoIP module and the Spamassassin "RelayCountryPlugin"? Seems that Mailscanner is already querying the IPs and producing the results required to create a rule.
Thanks!