#!!# ACL that is used after the RCPT command
check_recipient:
  # Exim 3 had no checking on -bs messages, so for compatibility
  # we accept if the source is local SMTP (i.e. not over TCP/IP).
  # We do this by testing for an empty sending host field.
  accept  hosts = :

deny message = Possible spam, rejected
  domains = +local_domains
  local_parts = ^.*[.]

# Use DNS blacklists to curb incomming spam
  #
  # Add a warning header if the sending host is in these
  # DNSBLs but acccept the message (or rather leave it for
  # later ACLs to accept/deny
       deny message = Message rejected $sender_fullhost is blacklisted at $dnslist_domain, see $dnslist_text
       dnslists     = zen.spamhaus.org
       warn message = X-Blacklisted-At: $dnslist_domain
       add_header   = X-Blacklisted-At: $dnslist_domain
 
       dnslists     = dnsbl.njabl.org
       warn message = X-Blacklisted-At: $dnslist_domain
       add_header   = X-Blacklisted-At: $dnslist_domain
 
       dnslists     = bl.spamcop.net
       warn message = X-Blacklisted-At: $dnslist_domain
       add_header   = X-Blacklisted-At: $dnslist_domain
 
       dnslists     = list.dsbl.org
       warn message = X-Blacklisted-At: $dnslist_domain
       add_header   = X-Blacklisted-At: $dnslist_domain
 
       dnslists     = cbl.abuseat.org
       warn message = X-Blacklisted-At: $dnslist_domain
       add_header   = X-Blacklisted-At: $dnslist_domain
 
#      deny message = The mail servers for the domain $sender_address_domain are listed at $dnslist_domain ($dnslist_value); see $dnslist_text
#      dnslists     = zen.spamhaus.org/<|${lookup dnsdb {>|a=<|${lookup dnsdb {>|mxh=$sender_address_domain} }} }
 
  # DNS List Check End
  #


  # Accept bounces to lists even if callbacks or other checks would fail
  warn     message      = X-WhitelistedRCPT-nohdrfromcallback: Yes
           condition    = \
           ${if and {{match{$local_part}{(.*)-bounces\+.*}} \
                     {exists {/usr/local/cpanel/3rdparty/mailman/lists/${lc:$1}/config.pck}}} \
                {yes}{no}}

  accept   condition    = \
           ${if and {{match{$local_part}{(.*)-bounces\+.*}} \
                     {exists {/usr/local/cpanel/3rdparty/mailman/lists/${lc:$1}/config.pck}}} \
                {yes}{no}}


  # Accept bounces to lists even if callbacks or other checks would fail
  warn     message      = X-WhitelistedRCPT-nohdrfromcallback: Yes
           condition    = \
           ${if and {{match{$local_part}{(.*)-bounces\+.*}} \
                     {exists {/usr/local/cpanel/3rdparty/mailman/lists/${lc:$1}_${lc:$domain}/config.pck}}} \
                {yes}{no}}

  accept   condition    = \
           ${if and {{match{$local_part}{(.*)-bounces\+.*}} \
                     {exists {/usr/local/cpanel/3rdparty/mailman/lists/${lc:$1}_${lc:$domain}/config.pck}}} \
                {yes}{no}}

  #if it gets here it isn't mailman
                                                                                                                                           
  #sender verifications are required for all messages that are not sent to lists
                                                                                                                                           
  #require verify = sender/callout
  #accept  domains = +local_domains
  #endpass
  
deny
!verify = sender/callout=30s,defer_ok,maxwait=60s
!senders = +whitelist_senders
accept domains = +local_domains
endpass  

                                                                                                                                       
  #recipient verifications are required for all messages that are not sent to the local machine
  #this was done at multiple users requests
                                                                                                                                           
  message = "The recipient cannot be verified.  Please check all recipients of this message to verify they are valid."
  verify = recipient
                                                                                                                                           
  accept  domains = +relay_domains

  warn  message = ${perl{popbeforesmtpwarn}{$sender_host_name}}
        hosts = +relay_hosts
  accept  hosts = +relay_hosts
                                                                                
  warn  message = ${perl{popbeforesmtpwarn}{$sender_host_address}}
        condition = ${perl{checkrelayhost}{$sender_host_address}}
  accept  condition = ${perl{checkrelayhost}{$sender_host_address}}

  accept  hosts = +auth_relay_hosts
          endpass
          message = $sender_fullhost is currently not permitted to \
                        relay through this server. Perhaps you \
                        have not logged into the pop/imap server in the \
                        last 30 minutes or do not have SMTP Authentication turned on in your email client.
          authenticated = *

  deny    message = $sender_fullhost is currently not permitted to \
                        relay through this server. Perhaps you \
                        have not logged into the pop/imap server in the \
                        last 30 minutes or do not have SMTP Authentication turned on in your email client.


#!!# ACL that is used after the DATA command
check_message:
#  Enabling this will make the server non-rfc compliant
#  require verify = header_sender
  #accept

deny
!verify   = header_sender
!senders  = +whitelist_senders
accept