# SPDX-License-Identifier: AGPL-3.0-only
# Any recipient postfix refused at smtpd time:
#   NOQUEUE: reject: RCPT from unknown[203.0.113.9]: 454 4.7.1 <x@y>: Relay access denied; ...
#   NOQUEUE: reject: RCPT from unknown[203.0.113.9]: 550 5.1.1 <x@y>: Recipient address rejected: ...
#
# ONE reject is not a verdict — a legitimate correspondent's server
# typoing an address writes this line too, which is why this parser
# belongs in a THRESHOLD rule (CrowdSec models it as a leaky bucket in
# postfix-spam), never in an instant one. Relay attempts specifically
# are covered by postfix-relay-denied, which IS instant-worthy.
parser: postfix-reject
log: mail
prefilter: "NOQUEUE: reject"
regex: '^(?P<time>[A-Z][a-z]{2} [ 0-9]\d \d{2}:\d{2}:\d{2}) \S+ postfix/smtpd\[\d+\]: NOQUEUE: reject: RCPT from \S+\[(?P<ip>[0-9a-fA-F.:]+)\]: \d{3} '
time_field: time
time_format: syslog
