Hello All,

I have a quick question... My company is running Qmail as our mail server and SpamAssassin as our spam filter.

My boss keeps getting a virus infected email everyday from the same sender, This has been happening for months. I was able to trace the email back and found the domain name and IP address it is coming from.

My questions is how do I block a domain name and/or an IP address is SpamAssassin or Qmail???

Thank you for any help you can provide!!!!

- Ryan

You can't really do that in Spamassassin. All Spamassassin really does is mark messages as being spam with the help of qmail-scanner. Sounds like you need to install Clam AV for virus scanning of those incoming messages. But for the immediate need, you just need to block an IP address.

Are you running vpopmail? The file you want is tcp.smtp. This could be in one of several places... /etc/tcp.smtp /home/vpopmail/etc/tcp.smtp (maybe other places, but these are the main ones).

Open that file in a text editor and add the following line...

123.456.789.10:deny,RBLSMTPD="-Too many viruses from your IP"

The ip address should (of course) be the ip address you want to block.