mail

Know where the mail really came from before you read it.

The Prefix WhoIs Milter, for Postfix and Sendmail, looks up the originating address found in the final Received or X-Originating-IP header — and the host actually delivering to you — then stamps the message with what the routing table knows about each.

Boring headers in, useful headers out

before

To: "You" <you@example.com>
From: "John Doe" <johndoe@example.com>

after pwhois-milter

To: "You" <you@example.com>
From: "John Doe" <johndoe@example.com>
X-PWhois-City: BROOMFIELD
X-PWhois-Region: COLORADO
X-PWhois-Country: UNITED STATES
X-PWhois-Org-Name: Level 3 Communications, Inc.
X-PWhois-AS-Org-Name: Level 3 Communications
X-PWhois-Deliverer-Origin-AS: 15169
X-PWhois-Deliverer-AS-Org-Name: Google

What it adds, and why

Headers of the form X-PWhois-Field-Name are appended for the Origin-AS, AS-Org-Name, Org-Name, Net-Name, Region, Country and Country-Code fields of the Prefix WhoIs response.

Route age is a spam signal — now it is an email header. Version 1.5.1 adds Route-Originated-Date and Route-Originated-TS, the date an AS first originated the sender's prefix, in human-readable and epoch form. Spammers love wheeling and dealing address blocks; a time threshold before you accept their mail is a new option.

The deliverer, too. As of 1.5 the milter also enriches based on the IP actually delivering to your server, under headers with "Deliverer" in the name — e.g. X-Pwhois-Deliverer-Origin-As: 15169. Origination headers are sometimes faked, and legitimate mass-mailers frequently perform delivery for illegitimate senders.

Running Rspamd? The same enrichment ships as a native plug-in for Rspamd, with no separate daemon to run.

Fail2Ban, too. Ban notices can carry the same routing data with one line of configuration; other ways in are on the Integrations page.

Safe under load. The milter has a safety timeout; if the network or Prefix WhoIs is slow, the message passes through unaltered and without further delay, so it is safe in high-volume environments.

Installation

Libmilter is required to build pwhois-milter — often available from your package repository (for example libmilter-dev on Debian-family systems) or from the Sendmail source distribution. Then:

# make && make install

…and copy the init script for your system into place. Neither Postfix nor Sendmail starts the milter for you; run the init script, or start it by hand:

pwhois-milter -i /path/to/pidfile.pid -l /path/to/logfile.log [ -u UID -g GID ]

Run it with no parameters to see every option.

Hooking it up

Postfix — add to the smtpd_milters chain in main.cf, separated from existing milters by a comma or space. Give it its own default_action=accept so mail is never delayed or refused if the milter is stopped or unreachable; enrichment is worth having, never worth losing a message over:

smtpd_milters = { inet:localhost:8472, default_action=accept }

The braces are the per-milter form (Postfix 3.0 and later). Recent Postfix releases changed the global milter_default_action default to shutdown, which disconnects a client after a milter error; the per-milter accept keeps this filter advisory regardless of that global setting.

Sendmail — not extensively tested, but this in sendmail.mc ought to work (F= unset means failures are ignored and the message passes unaltered):

INPUT_MAIL_FILTER(`PWhois Milter', `S=inet:8472@localhost, T=E:10s')

Log rotation — signal SIGUSR1 to reopen the log (SIGHUP terminates). Create the log file first with logrotate or touch; running unprivileged, the milter may not be able to create it, and it reopens only on its next log message.