5 files changed, 14 insertions, 17 deletions

diff --git a/src/mailman/chains/builtin.py b/src/mailman/chains/builtin.py
index 4263750bb..da5a81aee 100644
--- a/src/mailman/chains/builtin.py
+++ b/src/mailman/chains/builtin.py
@@ -48,6 +48,10 @@ class BuiltInChain:
         ('loop', LinkAction.jump, 'discard'),
         # Determine whether the member or nonmember has an action shortcut.
         ('member-moderation', LinkAction.jump, 'moderation'),
+        # Take a detour through the header matching chain.
+        ('truth', LinkAction.detour, 'header-match'),
+        # Check for nonmember moderation.
+        ('nonmember-moderation', LinkAction.jump, 'moderation'),
         # Do all of the following before deciding whether to hold the message.
         ('administrivia', LinkAction.defer, None),
         ('implicit-dest', LinkAction.defer, None),
@@ -58,11 +62,6 @@ class BuiltInChain:
         ('suspicious-header', LinkAction.defer, None),
         # Now if any of the above hit, jump to the hold chain.
         ('any', LinkAction.jump, 'hold'),
-        # Take a detour through the header matching chain, which we'll create
-        # later.
-        ('truth', LinkAction.detour, 'header-match'),
-        # Check for nonmember moderation.
-        ('nonmember-moderation', LinkAction.jump, 'moderation'),
         # Finally, the builtin chain jumps to acceptance.
         ('truth', LinkAction.jump, 'accept'),
         )
diff --git a/src/mailman/chains/docs/moderation.rst b/src/mailman/chains/docs/moderation.rst
index c239ec7a6..cd0a8eb26 100644
--- a/src/mailman/chains/docs/moderation.rst
+++ b/src/mailman/chains/docs/moderation.rst
@@ -83,6 +83,7 @@ built-in chain.  No rules hit and so the message is accepted.
         emergency
         loop
         member-moderation
+        nonmember-moderation
         administrivia
         implicit-dest
         max-recipients
@@ -90,7 +91,6 @@ built-in chain.  No rules hit and so the message is accepted.
         news-moderation
         no-subject
         suspicious-header
-        nonmember-moderation
 
 However, when Anne's moderation action is set to `hold`, her post is held for
 moderator approval.
@@ -207,13 +207,6 @@ moderator approval.
         emergency
         loop
         member-moderation
-        administrivia
-        implicit-dest
-        max-recipients
-        max-size
-        news-moderation
-        no-subject
-        suspicious-header
 
     >>> nonmember = mlist.nonmembers.get_member('bart@example.com')
     >>> nonmember
diff --git a/src/mailman/core/docs/chains.rst b/src/mailman/core/docs/chains.rst
index 0769df7f6..f5cbf2d89 100644
--- a/src/mailman/core/docs/chains.rst
+++ b/src/mailman/core/docs/chains.rst
@@ -269,8 +269,8 @@ This message will end up in the `pipeline` queue.
     Message-ID-Hash: 4CMWUN6BHVCMHMDAOSJZ2Q72G5M32MWB
     X-Message-ID-Hash: 4CMWUN6BHVCMHMDAOSJZ2Q72G5M32MWB
     X-Mailman-Rule-Misses: approved; emergency; loop; member-moderation;
-        administrivia; implicit-dest; max-recipients; max-size;
-        news-moderation; no-subject; suspicious-header; nonmember-moderation
+        nonmember-moderation; administrivia; implicit-dest; max-recipients;
+        max-size; news-moderation; no-subject; suspicious-header
     <BLANKLINE>
     An important message.
     <BLANKLINE>
diff --git a/src/mailman/docs/NEWS.rst b/src/mailman/docs/NEWS.rst
index 729f1e1f9..8d8d793b8 100644
--- a/src/mailman/docs/NEWS.rst
+++ b/src/mailman/docs/NEWS.rst
@@ -77,6 +77,11 @@ Message handling
    use a placeholder of the format `$<archiver-name>_url` to insert the
    permalink to the message in the named archiver, for any archiver enabled
    for the mailing list.  Given by Abhilash Raj.
+ * The default posting chain has been modified so that the header-match chain
+   and nonmember-moderation rule are processed before "hold" rules are
+   processed.  This allows for better anti-spam defenses and rejecting
+   non-member posts instead of always holding them for moderator review.
+   Given by Aurélien Bompard.  (Closes #163)
 
 REST
 ----
diff --git a/src/mailman/runners/docs/incoming.rst b/src/mailman/runners/docs/incoming.rst
index 03ed58df4..4877b1ad8 100644
--- a/src/mailman/runners/docs/incoming.rst
+++ b/src/mailman/runners/docs/incoming.rst
@@ -129,8 +129,8 @@ Now the message is in the pipeline queue.
     X-Message-ID-Hash: 4CMWUN6BHVCMHMDAOSJZ2Q72G5M32MWB
     Date: ...
     X-Mailman-Rule-Misses: approved; emergency; loop; member-moderation;
-        administrivia; implicit-dest; max-recipients; max-size;
-        news-moderation; no-subject; suspicious-header; nonmember-moderation
+        nonmember-moderation; administrivia; implicit-dest; max-recipients;
+        max-size; news-moderation; no-subject; suspicious-header
     <BLANKLINE>
     First post!
     <BLANKLINE>