Chapter 3 - Rules
CanIt-PRO allows you to make your own lists of senders, domains and hosts that
are always allowed to send you mail, or never allowed to send you mail. It also lets you create custom rules
and other types of rules. The following sections describe how to create these lists and rules.
3.1 The Sender Action Table
CanIt-PRO can take specific actions based on the sender's e-mail address. To see the
sender list, click on "Rules" and then "Senders". The sender page appears:
Figure 3.1: Sender Action Table
The columns in the table are:
Sender The e-mail address of a sender
Who The user who last modified the sender's disposition
Current Action The action taken by CanIt-PRO when a message from the sender arrives.
New Action Allows you to set a new action. The possible actions are:
- No Change - keep the current action
- Always allow - always allow mail from this sender without scanning for spam. (Dangerous attachments
are still scanned and stripped.)
- Always hold for approval - mail from this sender is always held for approval, even if
spam-scanning does not flag it as spam.
- Hold if looks like spam - this is the default; mail from this sender will be held if it
scores high enough on the spam scale.
- Always reject - messages from this sender are always rejected with a permanent failure code. The rejection
happens early on in the SMTP dialog, before any message body is transmitted.
- Delete from Table - the sender is deleted from the table. Also, CanIt-PRO treats the sender as if the
setting Hold if looks like spam had been used.
Comment Allows you to enter a comment if you like. This can help you remember why
you whitelisted or blacklisted a sender.
To set new actions, adjust the New Action entries appropriately and click Submit Changes.
If you want to set an action for an e-mail address that is not in the sender list, enter the
address in the text box and press enter. You will then be given an opportunity to set the action for that address.
For convenience, if you click on a sender address in the message summary (Section
2.1 ) or incident display (Section 2.5 ), CanIt-PRO will take
you to the sender entry for that address.
Click on Always Allow, Always Hold for Approval, Hold if Looks Like Spam, Always Reject
or All to restrict the sender page to senders who are always allowed, always held, held if the message
looks like spam, always rejected, or all senders, respectively.
Note: CanIt-PRO uses the Envelope Sender to determine the sender of an
e-mail. This may not necessarily be the address in the e-mail's From: header. Instead, you should look
at all the Internet headers using your e-mail client; the envelope sender will appear in the Return-Path: header.
Note: You cannot use wildcards in the Sender Action Table. For example, rejecting
*@domain.com will not work. Instead, reject domain.com in the Domain Action Table.
3.1.1 Holding Unlisted Senders
CanIt-PRO can allow you to decide to only accept mail from a specific list of sender addresses,
and to hold mail from all others. This essentially gives you the benefits of a challenge-response or sender opt-in system
without requiring that senders perform any extra additional actions before sending you a message.
To use this feature:
- Go to Rules : Senders and add the addresses of people you wish to receive mail from as Always allow.
- Enable the Hold mail from any sender not listed in Senders Table setting under Preferences : Stream Settings.
Messages from the addresses you whitelisted will be allowed, and all messages from senders not
specifically listed in the Sender Action Table will be held in your Pending trap, even if they score below
your spam threshold.
3.2 The Domain Action Table
Just as it can make decisions based on the sender's address, CanIt-PRO can make decisions based
just on the domain part of the address. (The domain part is everything after the @ sign. For example, the
domain part of info@roaringpenguin.com is roaringpenguin.com .)
To see the domain list, click on "Rules" and then "Domains". The domain list appears:
Figure 3.2: Domain Action Table
The columns and actions in the table have similar meanings to those the Sender
Action Table (Section 3.1 ).
Click on Always Allow, Always Hold for Approval, Hold if Looks Like Spam,
Always Reject or All to restrict the domain page to domains who are always allowed, always
held, held if the message looks like spam, always rejected, or all domains, respectively.
3.2.1 Domain Matching Rules
CanIt-PRO uses the same approach to match domains as Sendmail's access table does. Suppose you receive
e-mail from user@mail.sub.domain.net . CanIt-PRO performs the following domain lookups:
- mail.sub.domain.net
- sub.domain.net
- domain.net
- net
and the first entry in the database is selected. Thus, if you disallow e-mail from
baddomain.com, you also automatically block bouncer.baddomain.com and
spambox.baddomain.com. However, you can explicitly allow goodbox.baddomain.com
by adding another entry, because a domain with more components is more specific than (and takes preference
over) one with fewer components.
3.3 Bulk Blacklisting and Whitelisting
Entering a large number of hosts, domains or senders into the blacklist/whitelist tables can be
time consuming. CanIt-PRO provides an alternative interface for bulk entry.
To see the bulk entry page, click on "Rules" and then "Bulk Entry":
Figure 3.3: Bulk Entry
- Enter the items you want to blacklist or whitelist, one per line. If you wish to enter item-specific comments, enter
them following a pound symbol, like this:
item # item-specific comment
In the bulk-entry text box, blank lines and lines starting with a pound sign are ignored.
- If you want a global comment to apply to all items that lack an item-specific comment, enter the comment in
the Global comment entry box.
- Select the action. Depending on your access rights, you can bulk-enter senders, hosts and domains. Choose the
appropriate entry type and action from the menu.
- Click Submit Changes to submit the bulk data.
3.4 Filename Extensions
CanIt-PRO allows you to hold or reject e-mail with attachments whose filenames end in certain
extensions. Some filename extensions may pose a risk to Windows machines.
To see the filename extension list, click on "Rules" and then "Filename Extensions":
Figure 3.4: Filename Extensions
For each extension, you can Accept, Hold, Discard or Reject e-mail containing the
extension. Note that the default is Accept . This does not mean that mail will be specifically accepted regardless
of other factors; it just means that it will not be rejected because of an extension.
If you set "Handling for messages containing Windows executables" to anything other than
Accept, you can override the built-in extensions by explicitly setting them to Accept here. For example,
if you would like to accept url files, you can add an Accept setting for url, and this setting will override
the entry in the built-in list of dangerous extensions.
Note that you should not include the period in the extension. For example, if you want to
block files ending in .exe , enter "exe", not ".exe". Filename extension matching is case-insensitive.
To enter a new extension in the list, enter it in the "Enter a specific filename extension:"
input box and press Enter.
With filename extensions, you can specify a different action for whitelisted senders. If a sender
address is whitelisted, then the action in the Action for Whitelisted Senders column applies. Otherwise,
the General Action applies. You might use this, for example, to hold ZIP files for most people, but allow
them for whitelisted senders.
3.4.1 Matching Entire File Names
In the Filename Extension list, you can match an entire file name by prefixing the name with "^".
For example, the entry ^message.zip will match if the entire filename is message.zip (using a case-insensitive
comparison, of course.)
