These antispam tips are for Exim 4.x. If you don't know how to modify the helo, rcpt, and data ACLs, then these suggestions won't do you much good.
I've also done a study on Spellchecking as an Antispam Tool. Unfortunately, the results are not very encouraging.
You can block a lot of spammers right after they say HELO. They have a tendency to lie but, fortunately, it's often easy to catch them in their lie.
The first thing a remote system is supposed to do when it connects is to say "HELO domain.com". It is legal to use an ip address with the HELO, but losing acceptance. A spammer might try to HELO with your own ip address. There is absolutely no legitimate reason for someone else to use your ip address here. Plug your own ip address in here where it says ##.##.##.##. Repeat this for each IP address you handle.
Basically the same thing as the previous filter, but using your domain name instead of your ip address. You should repeat this filter for each domain you control.
Giving a domain name of 'none' isn't valid, so tell them to bugger off. This filter can be left out since the "period" filter below will catch it.
A remote system saying they are localhost? Sure they are. This filter can also be omitted if you use the "period" filter below.
A proper domain will contain at least one period. A good percentage of spam worms HELO with random characters without a period.
Spammers like to forge some big names when they send you email. We can't easily check all of them, not until Sender Permitted From (SPF) is widely used. At least we can check for some of the most commonly abused domains, Yahoo, Hotmail, MSN, and AOL. These four filters will reject email with forged From: addresses containing the "big four" domains.
Of course, using a few good blacklists is a good idea. I put my blacklist checks immediately after the big four filters.
A valid email should have a message id. Spamming software (and viruses) often don't. So refuse them. Note, this filter has been known to break the rare email sent from a highly customized Qmail server. Personally, I dont' care.
Email should have a proper date. So goodbye if it doesn't.
You'll need the Exiscan patch for the mime handling to work.
Required to do any mime handling, plus, a broken mime attachment might be an attempt to infect or break into your system.
Refuse dangerous attachments. This gets a large number of viruses. It also catches a lot of spam with hidden surprises.
For Windows clients, Microsoft has included a lovely little surprise. It is possible to attach a file with a CLSID in the name which causes Windows to hide the file extension. This is entirely independent of the "Hide file extensions for known file types" folder option. This is extremely dangerous, so lets just refuse the bastards.
This isn't an Exim trick, but is highly useful. Spammers have bots that scoure web pages for email addresses to add to their databases. Hiding your email address will reduce your spam, but often at the expense of convenience to real people. Here's a little bit of javascript that will obscure your mailto links from bots, but still work perfectly for humans clicking on the links so long as they have javascript enabled. Unfortunately, if javascript is disabled nothing is displayed.
Add the following in the header section of your web page:
Instead of using an anchor to add the link, just add a bit of javascript:
The first argument is the clickable link text. The second argument is the name portion of the email address. The third argument is the domain. The fourth argument is an optional subject. Pass an empty string if you don't wish a default subject.
Businesses in the greater San Francisco Bay Area requiring assistance to implement antispam filters, virus prevention, or general mail server configuration can contact me via .