header		IP_NAME_LOOKUP_FAILED			X-Warn-Resolve =~ /IP name lookup failed/
describe	IP_NAME_LOOKUP_FAILED			IP name lookup failed
score		IP_NAME_LOOKUP_FAILED			1.5

header		IP_NAME_FORGED				X-Warn-Resolve =~ /IP name forged/
describe	IP_NAME_FORGED				IP name forged
score		IP_NAME_FORGED				1.5

header		HELO_LITERAL				X-Warn-HELO-Blacklisted =~ /Literal used in HELO/
describe	HELO_LITERAL				Literal used in HELO
score		HELO_LITERAL				1.0

header		HELO_PC_DOMAIN				X-Warn-HELO-Blacklisted =~ /Suspicious sender HELO \*-pc\.domain$/
describe	HELO_PC_DOMAIN				Suspicious sender HELO *-pc.domain
score		HELO_PC_DOMAIN				5.0

header		HELO_DOT_DOMAIN				X-Warn-HELO-Blacklisted =~ /Suspicious sender HELO \*\.domain$/
describe	HELO_DOT_DOMAIN				Suspicious sender HELO *.domain
score		HELO_DOT_DOMAIN				5.0

header		__ESMTP_WITHOUT_SIZE			X-Warn-ESMTP-SIZE =~ /ESMTP used and parameter SIZE not found in MAIL FROM command/
meta		ESMTP_WITHOUT_SIZE			__ESMTP_WITHOUT_SIZE && !GMAIL_COM && !__GETRESPONSE_COM
describe	ESMTP_WITHOUT_SIZE			Protocol ESMTP used without parameter SIZE in MAIL FROM command
score		ESMTP_WITHOUT_SIZE			0.3

header		MIME_ERRORLEVEL_1			X-Warn-MIME =~ /^\s*This message contains a MIME error\. errorlevel: 1;/
describe	MIME_ERRORLEVEL_1			This message contains a MIME error, errorlevel 1
score		MIME_ERRORLEVEL_1			2.0

header		MIME_ERRORLEVEL_2			X-Warn-MIME =~ /^\s*This message contains a MIME error\. errorlevel: 2;/
describe	MIME_ERRORLEVEL_2			This message contains a MIME error, errorlevel 2
score		MIME_ERRORLEVEL_2			3.5

header		MIME_ERRORLEVEL_3			X-Warn-MIME =~ /^\s*This message contains a MIME error\. errorlevel: 3;/
describe	MIME_ERRORLEVEL_3			This message contains a MIME error, errorlevel 3
score		MIME_ERRORLEVEL_3			5.0

header		FORGED_HELO_NO_CORRESPONDE_RELAY_NAME	X-Warn-HELO-Forged =~ /^\s*Forged HELO used \(HELO \S+ does not correspond to relay hostname/
describe	FORGED_HELO_NO_CORRESPONDE_RELAY_NAME	Helo doesn't corresponde to relay hostname
score		FORGED_HELO_NO_CORRESPONDE_RELAY_NAME	1.5

header		__FORGED_HELO_NO_CORRESPONDE_RELAY_ADDR	X-Warn-HELO-Forged =~ /^\s*Forged HELO used \((A|AAAA) record of HELO \S+ does not correspond to relay address/
meta		FORGED_HELO_NO_CORRESPONDE_RELAY_ADDR	__FORGED_HELO_NO_CORRESPONDE_RELAY_ADDR && !__HAS_X_MS_Office365_Filtering_Correlation_Id
describe	FORGED_HELO_NO_CORRESPONDE_RELAY_ADDR	A/AAAA record of helo hostname doesn't corresponde to relay address
score		FORGED_HELO_NO_CORRESPONDE_RELAY_ADDR	2.0

header		FORGED_HELO_DOESNT_RESOLVE		X-Warn-HELO-Forged =~ /^\s*Forged HELO used \(HELO \S+ does not resolve\)/
describe	FORGED_HELO_DOESNT_RESOLVE		Helo doesn't resolve
score		FORGED_HELO_DOESNT_RESOLVE		2.5

header		FORGED_PTR_DOESNT_RESOLVE		X-Warn-HELO-Forged =~ /^\s*Forged HELO used \(sender host address \S+ does not resolve\)/
describe	FORGED_PTR_DOESNT_RESOLVE		Sender host address doesn't resolve
score		FORGED_PTR_DOESNT_RESOLVE		1.5

header		FORGED_PTR_RESOLVE_DEFER		X-Warn-HELO-Forged =~ /^\s*(Cannot|Could not|Couldn't) resolve PTR record for/
describe	FORGED_PTR_RESOLVE_DEFER		Sender host address doesn't resolve
score		FORGED_PTR_RESOLVE_DEFER		0.5

header		X_Quarantine_HELO			X-Quarantine-HELO =~ /\S/
describe	X_Quarantine_HELO			Sender helo quarantined (already_read)
score		X_Quarantine_HELO			5.0

header		X_Quarantine_Sender			X-Quarantine-Sender =~ /\S/
describe	X_Quarantine_Sender			Sender address quarantined (already_read)
score		X_Quarantine_Sender			5.0

header		X_Quarantine_Relay			X-Quarantine-Relay =~ /\S/
describe	X_Quarantine_Relay			Sender relay quarantined (already_read)
score		X_Quarantine_Relay			5.0

header		X_Quarantine_Recipient			X-Quarantine-Recipient =~ /\S/
describe	X_Quarantine_Recipient			Recipient address quarantined (already_read)
score		X_Quarantine_Recipient			5.0

header		X_Quarantine_Sender_Verify		X-Quarantine-Sender-Verify =~ /\S/
describe	X_Quarantine_Sender_Verify		Sender verify failed (already_read)
score		X_Quarantine_Sender_Verify		5.0

header		SENDER_DOMAIN_NO_MX			X-Warn-Mail-MX =~ /^\s*MX record of sender domain \S+ blacklisted: Sender domain does not have any MX records$/
describe	SENDER_DOMAIN_NO_MX			Sender domain does not have any MX records
score		SENDER_DOMAIN_NO_MX			0.5

header		SPF_NEUTRAL				X-Warn-SPF =~ /^\s*\S+: \d+\.\d+\.\d+\.\d+ is neither permitted nor denied by domain of \S+ \(SPF check result is neutral\)$/
describe	SPF_NEUTRAL				Sender host is neither permitted nor denied by sender domain (SPF check result is neutral)
score		SPF_NEUTRAL				1.0

header		TXT_RECORD_STRANGE			X-Warn-Mail-TXT =~ /Strange network number in SPF record/
describe	TXT_RECORD_STRANGE			Strange TXT record
score		TXT_RECORD_STRANGE			5.0

header		SPF_RECORD_STRANGE			X-Warn-Mail-SPF =~ /Strange network number in SPF record/
describe	SPF_RECORD_STRANGE			Strange SPF record
score		SPF_RECORD_STRANGE			5.0

header		TXT_RECORD_MAILRU_VERIFICATION		X-Warn-Mail-TXT =~ /Sender domain with strange TXT record "mailru-verification" without value/
describe	TXT_RECORD_MAILRU_VERIFICATION		Sender domain with strange TXT record "mailru-verification" without value
score		TXT_RECORD_MAILRU_VERIFICATION		4.0

header		SSP_SOFT_NONE				X-Warn-SSP =~ / has a "~" SSP policy and DKIM signature not found/
describe	SSP_SOFT_NONE				From domain has a "~" SSP policy, but DKIM verify status is none
score		SSP_SOFT_NONE				2.0

header		ADSP_ALL_NONE				X-Warn-ADSP =~ / has a "all" ADSP policy and DKIM signature not found/
describe	ADSP_ALL_NONE				From domain has a "all" ADSP policy, but DKIM verify status is none
score		ADSP_ALL_NONE				3.0

header		ADSP_DISCARDABLE_NONE			X-Warn-ADSP =~ / has a "discardable" ADSP policy and DKIM signature not found/
describe	ADSP_DISCARDABLE_NONE			From domain has a "all" ADSP policy, but DKIM verify status is none
score		ADSP_DISCARDABLE_NONE			5.0

header		Suspicious_Registrant_Phone		X-Warn-Sender =~ /^\s*sender address \S+ blacklisted: Suspicious Registrant Phone/
describe	Suspicious_Registrant_Phone		Suspicious Registrant Phone
score		Suspicious_Registrant_Phone		5.0

header		__SUSP_DEFAULT_SPF_POLICY_1_TXT		X-Warn-Mail-TXT =~ /^\s*Suspicious default SPF policy in SPF record "v=spf1 \+all"/
header		__SUSP_DEFAULT_SPF_POLICY_1_SPF		X-Warn-Mail-SPF =~ /^\s*Suspicious default SPF policy in SPF record "v=spf1 \+all"/
meta		SUSP_DEFAULT_SPF_POLICY_1		__SUSP_DEFAULT_SPF_POLICY_1_TXT || __SUSP_DEFAULT_SPF_POLICY_1_SPF
describe	SUSP_DEFAULT_SPF_POLICY_1		Suspicious default SPF policy in SPF record (sa-learn_candidate)
score		SUSP_DEFAULT_SPF_POLICY_1		5.0

#header		__SUSP_DEFAULT_SPF_POLICY_2_TXT		X-Warn-Mail-TXT =~ /^\s*Suspicious default SPF policy in SPF record "v=spf1 \+mx \+a \+all"/
#header		__SUSP_DEFAULT_SPF_POLICY_2_SPF		X-Warn-Mail-SPF =~ /^\s*Suspicious default SPF policy in SPF record "v=spf1 \+mx \+a \+all"/
header		__SUSP_DEFAULT_SPF_POLICY_2_TXT		X-Warn-Mail-TXT =~ /^\s*Suspicious default SPF policy in SPF record "v=spf1( \+?mx| \+?a)+ \+all"/
header		__SUSP_DEFAULT_SPF_POLICY_2_SPF		X-Warn-Mail-SPF =~ /^\s*Suspicious default SPF policy in SPF record "v=spf1( \+?mx| \+?a)+ \+all"/
meta		SUSP_DEFAULT_SPF_POLICY_2		(__SUSP_DEFAULT_SPF_POLICY_2_TXT || __SUSP_DEFAULT_SPF_POLICY_2_SPF) && !SUSP_DEFAULT_SPF_POLICY_1
describe	SUSP_DEFAULT_SPF_POLICY_2		Suspicious default SPF policy in SPF record (sa-learn_candidate)
score		SUSP_DEFAULT_SPF_POLICY_2		3.8

header		__SUSP_DEFAULT_SPF_POLICY_TXT		X-Warn-Mail-TXT =~ /^\s*Suspicious default SPF policy in SPF record "v=spf1.* \+all"/
header		__SUSP_DEFAULT_SPF_POLICY_SPF		X-Warn-Mail-SPF =~ /^\s*Suspicious default SPF policy in SPF record "v=spf1.* \+all"/
meta		SUSP_DEFAULT_SPF_POLICY			(__SUSP_DEFAULT_SPF_POLICY_TXT || __SUSP_DEFAULT_SPF_POLICY_SPF) && !SUSP_DEFAULT_SPF_POLICY_1 && !SUSP_DEFAULT_SPF_POLICY_2
describe	SUSP_DEFAULT_SPF_POLICY			Suspicious default SPF policy in SPF record (sa-learn_candidate)
score		SUSP_DEFAULT_SPF_POLICY			3.0

header		__SENDER_HOST_OS_WINDOWS_7_8		X-Warn-Relay-OS =~ /^\s*sender host OS Windows 7 or 8 detected/
describe	__SENDER_HOST_OS_WINDOWS_7_8		Sender host OS Windows 7 or 8 detected
score		__SENDER_HOST_OS_WINDOWS_7_8		0.01

header		TRAFLINKS_MAIL				X-Warn-Mail =~ /^\s*Message from traflinks\.com$/
describe	TRAFLINKS_MAIL				Message from traflinks.com
score		TRAFLINKS_MAIL				3.0

header		TRAFLINKS_HELO				X-Warn-Helo =~ /^\s*Message from traflinks\.com$/
describe	TRAFLINKS_HELO				Message from traflinks.com
score		TRAFLINKS_HELO				3.0