How this system filters mail

The basic principle is, that if someone calls at your door wearing a ski mask, (obscuring their identity) you don't answer it;

Syntax check
The entire SMTP session should use a correct syntax.
Reverse lookup
This host will do a reverse lookup of the remote host's IP address. If this fails the mail will be refused. If the reverse lookup succeeds it will lookup the remote host's IP address. If this fails mail will be refused.
This of course also means that if your system administrator or ISP is too lazy or stupid to configure their nameserver correctly, your mail will be refused.
Remote host MX check
The remote host has to be in a domain with a MX. The MX has to be a hostname and should not resolve to '127.0.0.1' or RFC 1918 addresses.
Helo check
The HELO / EHLO should be a Fully Qualified Domain Name. The name should match the IP address or vice versa.
This of course also means that if your system administrator or ISP is too lazy or stupid to configure their mailserver correctly, your mail will be refused.
To limit false positives this system will also try to match the domain part, without the tld, of the helo and the hostname.
If this also fails it will lookup the MX of the helo and try to match that with the hostname.
If all of these fail the remote hosts is considered to be a zombie box.
Blacklists
Besides a local blacklist, the following distributed DNS based blacklists are used:
- cbl.abuseat.org
- Abusive Hosts Blocking List
- virbl.bit.nl
- Distributed Sender Boycott List
- Day Old Bread List
- RFC ignorant org
- SpamCop
- The Spamhaus Project
These lists blacklist either the IP address or sender domain.
MX Check.
There has to be an MX for both the transport and content from domain. The MX can not be an IP address but has to be a hostname.
Sender and receiver verification.
It does this for both the content and transport to and from. It does this by means of a 'Callout':
The mailserver makes SMTP connections to the remote MX(es), to test whether a bounce message could be delivered to a sender address, or whether the current message could be delivered to a recipient address. For a sender address, it sends:
```
  HELO <primary host name>
  MAIL FROM:<>
  RCPT TO:<the address to be tested>
  QUIT
  
```
If the 'RCPT TO:' causes an error, a fake email address is used and the mail will be rejected. The existence of postmaster is tested in the same way.
There is also a test with a random address. If the remote MX pretends that this address exists, all mail form that domain is rejected.
SPF
Sender Permitted From. A way to prevent joe-jobs.
Size checking
Large email's are rejected by this system. The size check is done both after RCPT and just before completion of the DATA phase.
This also stops large worms.
Message-Id
The message should have a RFC compliant Message-Id. The correct format is; Some_Unique_String@Host.Domain.Tld eg;
Message-Id: <E1BnfcM-0000bf-GI@mail.example.com>
Plain text check
If the entire message is base64 encoded, it will be rejected.
HTML blocking
HTML only mail is rejected by this system. On top of that this system blocks any mail from outside the EU containing HTML tags.
Mime checking
Proprietary file types are rejected by this system. This also stops viruses.
Virus check
ClamAV™: Project News
SpamAssassin
SpamAssassin is a program which looks for spam specific strings.
Virus warning blocking
An additional SpamAssassin rule blocks so called 'virus warnings' (which are in effect anti virus software spam.
SURBL
The Spam URI Realtime Blocklists lists sites advertised in spam.
DCC
Distributed Checksum Clearinghouse is a blacklist which blacklists hashes of known spam message bodies.
Pyzor
Pyzor is a blacklist which blacklists hashes of known spam message bodies.
Razor
Vipul's Razor is a blacklist which blacklists hashes of known spam message bodies.

How to do the above with Exim.