1.0.98: match rules can also reject at SMTP time

Match rules can also reject at SMTP time

A match rule used to act only inside MailScanner: the message was accepted, queued, scanned, scored 100 and dropped, and the source banned a minute later from the log — a bot sending the same subject a thousand times still cost a thousand scans. A rule can now carry Also reject at SMTP time (subject, from, to and header rules; not body): Exim refuses the message at DATA with 550 Rejected by local policy (MSFE-NG rule #n), nothing is queued, MailScanner never sees it, and the minute cron bans the source from /var/log/exim_rejectlog (reason smtp, the usual exclusions). The SpamAssassin rule stays in place as the second line of defence.

• Never refused: authenticated submissions, loopback, and every sender on the global or a domain's whitelist (written to /etc/msfe-ng/exim/smtp-deny-whitelist).
• Wiring: one deny stanza per flagged rule in /etc/msfe-ng/exim/smtp-deny.conf, included from cPanel's message-check ACL hook (ACL_CHECK_MESSAGE_PRE_BLOCK/custom_begin_check_message_pre), regenerated on every save and sync, validated by exim -be and exim -bV, rolled back when Exim refuses it, and followed by an Exim restart whenever it changed. Every pattern is escaped so nothing in it can reach Exim's string expansion.
• Visibility: an SMTP column with the day's count in the Rules-tab and Config tables, and a Refused at SMTP time block in the Rules tab listing the last 50 refused messages (these never reach the Messages tab). GET /api/autoban/rejects.
• Doctor SMTP-time rejects wired: a stale or missing fragment is fixed by sync (--fix); a hook the built exim.conf does not include gets the host checklist.
• CLI: msfe-ng autoban rejects [--limit n] [--json], msfe-ng autoban smtp-off (the kill switch). uninstall.sh removes the fragment and the hook line.

Verify on your host before relying on it. The cPanel block directory above is cPanel's documented hook point for acl_smtp_data, but MSFE-NG could not check its name from the build machine. After flagging the first rule, run msfe-ng doctor: the check must say ok (the built /etc/exim.conf includes the fragment); otherwise ls /usr/local/cpanel/etc/exim/acls/ must list the block — if cPanel names it differently, set MSFE_NG_SMTP_DENY_BLOCK=<name> for the daemon and the cron, re-save a rule and rebuild. Then send a test message with the banned subject from outside: it must bounce with the 550. The wiki's Rules → Reject at SMTP time has the checklist.

Wiki: Rules, Config, Troubleshooting, CLI. Upgrade: msfe-ng upgrade, or the Service tab.