Apply Policy Filters with Qmail-Scanner

"Qmail-Scanner is an add-on that enables a Qmail email server to scan gatewayed email for certain characteristics (i.e. a content scanner). It is typically used for its anti-virus and anti-spam protection functions, in which case it is used in conjunction with external scanners. It also enables a site (at a server/site level) to create "Policy blocks": i.e. react to email that contains specific strings in particular headers, or particular attachment filenames or types (e.g. *.VBS attachments)." [1]

"Policy blocks" allow qmail-scanner to block emails which contain particular characteristics, i.e. subject lines, senders, and attachments (size or type). The file, /var/spool/qscan/quarantine-events.txt defines the various blocks. The format of the block is relatively simple. A block consists of three items: variable, type and description. A variable is the thing you want to block. Type is either a mail header or a file attachment/extension. A description described what is being blocked and why. A TAB separates each of the three items. There are numerous examples provided in the quarantine.txt file. The below example blocks annoying winmail.dat attachments. Derek Whitten provided this example to the QMR mailing list. Note in this example, the "<TAB>" represents the use of the TAB character.

winmail.dat<TAB>SIZE=-1<TAB>Rich Text Format Emails Not Allowed. Please change your composition settings in Outlook. Please see http://email.about.com/od/outlooktips/ss/wt121705.htm for instructions.

The above example blocks any email containing an attachment "winmail.dat" of any size. It returns the message "Rich Text Format Emails Not Allowed. Please change your composition settings in Outlook. Please see http://email.about.com/od/outlooktips/ss/wt121705.htm for instructions." to the addresses specified by the "--notify" options in the ./configure statement.