The use of mail rules is controlled by the environment variable $MAILRULES. This variable specifies the path to the mail rules file. If $MAILRULES is set but the path that it points to cannot be opened, processing will fail with a temporary error. There is no default value -- if it is not set, mail rules processing is disabled.
The rules listed are applied before any other sender or recipient processing is done (such as checking against qmail's badmailfrom file).
Each rule in the file occupies a single line and has exactly the same format. Each line starts with one of the following prefixes:
The following escape sequences are recognized in all the fields:
A pattern is a string of stars and non-stars. It matches any concatenation of strings matched by all the stars and non-stars in the same order. A non-star matches itself. A star before the end of pattern matches any string that does not include the next character in pattern. A star at the end of pattern matches any string. Patterns containing only "*" match anything. Note: An empty pattern matches only the empty string.
The following patterns are treated specially:
Each rule is applied in the order they are listed in the rules file until one matches. At that point, the command that triggered the rule search is accepted, deferred, or rejected depending on the rule type. If the sender is not accepted, no recipients can be accepted, as usual. As long as at least one recipient is accepted the message data may be accepted.
Rules with a recipient pattern of * will be tested when the client transmits the sender address. Otherwise rules are be tested when the client transmits the recipient address.
The following rules provide the functionality similar to that available in qmail-smtpd. Please note that the qmail validation routines already provide this functionality. These rules are listed for illustrative purposes only.
d[[/var/qmail/control/badmailfrom]]:*:sorry, your envelope sender is in my badmailfrom list (#5.7.1) k*:[[@/var/qmail/control/rcpthosts]] k*:[[@/var/qmail/control/morercpthosts.cdb]]
The following rules block old exploitable addresses that are still commonly probed: bang paths, multiple domains, and percent hacks.
d*:*!*: Sorry, we don't allow that here d*:*@*@*: Sorry, we don't allow that here d*:*%*: Sorry, percent hack not accepted here