# # 2003-2022 Victor Ustugov # # Redefine some scores # ###{ BITCOIN_DEADLINE # #meta BITCOIN_DEADLINE __BITCOIN_ID && __HOURS_DEADLINE && !BITCOIN_EXTORT_01 #describe BITCOIN_DEADLINE BitCoin with a deadline ##score BITCOIN_DEADLINE 3.000 # limit #tflags BITCOIN_DEADLINE publish ###} BITCOIN_DEADLINE describe BITCOIN_DEADLINE BitCoin with a deadline (sa-learn_candidate) score BITCOIN_DEADLINE 3.000 ###{ GB_BITCOIN_CP # #meta GB_BITCOIN_CP ( __GB_BITCOIN_CP_DE || __GB_BITCOIN_CP_ES || __GB_BITCOIN_CP_EN || __GB_BITCOIN_CP_FR || __GB_BITCOIN_CP_IT || __GB_BITCOIN_CP_NL || __GB_BITCOIN_CP_SE ) #describe GB_BITCOIN_CP Localized Bitcoin scam ##score GB_BITCOIN_CP 3.0 # limit ###} GB_BITCOIN_CP describe GB_BITCOIN_CP Localized Bitcoin scam (sa-learn_candidate) #score XPRIO 2.805 3.260 2.805 3.260 score XPRIO 2.0 ###{ T_DKIM_INVALID ifplugin Mail::SpamAssassin::Plugin::DKIM # #ifplugin Mail::SpamAssassin::Plugin::DKIM # meta T_DKIM_INVALID __DKIM_EXISTS && !DKIM_VALID # describe T_DKIM_INVALID DKIM-Signature header exists but is not valid #endif ###} T_DKIM_INVALID ifplugin Mail::SpamAssassin::Plugin::DKIM score T_DKIM_INVALID 2.0 #meta DKIM_INVALID DKIM_SIGNED && !DKIM_VALID #describe DKIM_INVALID DKIM or DK signature exists, but is not valid #score DKIM_INVALID 0.1 score DKIM_INVALID 1.0 #header __SANE_MSGID MESSAGEID =~ /^<[^<>\\ \t\n\r\x0b\x80-\xff]+\@[^<>\\ \t\n\r\x0b\x80-\xff]+>\s*$/m #header __HAS_MSGID MESSAGEID =~ /\S/ #header __MSGID_COMMENT MESSAGEID =~ /\(.*\)/m #meta INVALID_MSGID __HAS_MSGID && !(__SANE_MSGID || __MSGID_COMMENT) #describe INVALID_MSGID Message-Id is not valid, according to RFC 2822 #score INVALID_MSGID 2.602 1.167 1.328 0.568 score INVALID_MSGID 2.4 #header FSL_CTYPE_WIN1251 Content-Type =~ /charset="Windows-1251"/ #describe FSL_CTYPE_WIN1251 Content-Type only seen in 419 spam #score FSL_CTYPE_WIN1251 4.095 3.999 4.095 3.999 score FSL_CTYPE_WIN1251 0.01 #header KHOP_BIG_TO_CC ToCc =~ /(?:[^,\@]{1,60}\@[^,]{4,25},){10}/ #describe KHOP_BIG_TO_CC Sent to 10+ recipients instaed of Bcc or a list #score KHOP_BIG_TO_CC 3.300 3.399 3.300 3.399 score KHOP_BIG_TO_CC 1.0 #urirhssub URIBL_DBL_REDIR dbl.spamhaus.org. A 127.0.1.3 #body URIBL_DBL_REDIR eval:check_uridnsbl('URIBL_DBL_REDIRECTOR') #describe URIBL_DBL_REDIR Contains a URL listed in the DBL as a spammed redirector domain #tflags URIBL_DBL_REDIR net domains_only #score URIBL_DBL_REDIR 0 0.001 0 0.001 score URIBL_DBL_REDIR 2.0 #meta FROM_12LTRDOM __FROM_12LTRDOM_1 && !__VIA_ML && !__TO___LOWER && !__FS_SUBJ_RE && !__RCD_RDNS_MAIL_MESSY && !__freemail_safe && !__UNSUB_LINK && !NO_RELAYS && !__UNUSABLE_MSGID && !DATE_IN_PAST_96_XX && !ALL_TRUSTED && !__MSGID_APPLEMAIL && !__RCD_RDNS_SMTP_MESSY && !__FB_NATIONAL && !__MAIL_LINK && !__NAME_EMAIL_DIFF && !__RCD_RDNS_MX_MESSY && !__RCD_RDNS_MX && !__SENDER_BOT && !__IMS_MSGID && !__HS_SUBJ_RE_FW && !__DOS_HAS_LIST_UNSUB #describe FROM_12LTRDOM From a 12-letter domain #header __FROM_12LTRDOM_1 From =~ /\@[a-z]{12}\./ #score FROM_12LTRDOM 2.602 2.027 2.602 2.027 score FROM_12LTRDOM 0 ## must keep it in sync with http://www.iana.org/assignments/ipv4-address-space/ #header RCVD_ILLEGAL_IP X-Spam-Relays-Untrusted =~ / (?:by|ip)=(?=\d+\.\d+\.\d+\.\d+ )(?:0|2(?:2[4-9]|[3-5]\d)|192\.0\.2|198\.51\.100|203\.0\.113)\./ #describe RCVD_ILLEGAL_IP Received: contains illegal IP address #score RCVD_ILLEGAL_IP 3.399 score RCVD_ILLEGAL_IP 1.0 #meta FORGED_OUTLOOK_HTML (!__YAHOO_BULK && __ANY_OUTLOOK_MUA && MIME_HTML_ONLY) #describe FORGED_OUTLOOK_HTML Outlook can't send HTML message only #score FORGED_OUTLOOK_HTML 0.001 0.001 0.001 0.021 score FORGED_OUTLOOK_HTML 2.0 ###{ FSL_RU_URL #uri FSL_RU_URL /[^\/]+\.ru(?:$|\/|\?)/i ##score FSL_RU_URL 0.01 ###} FSL_RU_URL #score FSL_RU_URL 3.499 2.271 3.499 2.271 score FSL_RU_URL 0.01 #header RATWARE_MPOP_WEBMAIL X-Mailer =~ /mPOP Web-Mail/i #describe RATWARE_MPOP_WEBMAIL Bulk email fingerprint (mPOP Web-Mail) #score RATWARE_MPOP_WEBMAIL 1.153 1.338 1.229 1.999 # n=0 score RATWARE_MPOP_WEBMAIL 1.0 #score SUBJECT_NEEDS_ENCODING 2.306 1.277 0.636 0.001 # n=2 score SUBJECT_NEEDS_ENCODING 2.306 1.277 0.80 0.50 #meta DOS_OE_TO_MX_IMAGE __OE_MUA && __DOS_DIRECT_TO_MX && __ANY_IMAGE_ATTACH #describe DOS_OE_TO_MX_IMAGE Direct to MX with OE headers and an image describe DOS_OE_TO_MX_IMAGE Direct to MX with OE headers and an image (DSPAM_autolearn) #score DOS_OE_TO_MX_IMAGE 3.0 score DOS_OE_TO_MX_IMAGE 7.5 #meta DOS_OE_TO_MX __OE_MUA && __DOS_DIRECT_TO_MX && !DOS_OE_TO_MX_IMAGE #describe DOS_OE_TO_MX Delivered direct to MX with OE headers describe DOS_OE_TO_MX Delivered direct to MX with OE headers (DSPAM_autolearn) #score DOS_OE_TO_MX 2.75 score DOS_OE_TO_MX 7.0 ##meta DOS_OUTLOOK_TO_MX_IMAGE __ANY_OUTLOOK_MUA && !__OE_MUA && __DOS_DIRECT_TO_MX && __ANY_IMAGE_ATTACH ##describe DOS_OUTLOOK_TO_MX_IMAGE Direct to MX with Outlook headers and an image ##score DOS_OUTLOOK_TO_MX_IMAGE 1.059 #score DOS_OUTLOOK_TO_MX_IMAGE 3.5 #meta T_DOS_OUTLOOK_TO_MX_IMAGE __ANY_OUTLOOK_MUA && !__OE_MUA && __DOS_DIRECT_TO_MX && __ANY_IMAGE_ATTACH #describe T_DOS_OUTLOOK_TO_MX_IMAGE Direct to MX with Outlook headers and an image score T_DOS_OUTLOOK_TO_MX_IMAGE 3.5 #meta DOS_OUTLOOK_TO_MX __ANY_OUTLOOK_MUA && !__OE_MUA && __DOS_DIRECT_TO_MX && !DOS_OUTLOOK_TO_MX_IMAGE #describe DOS_OUTLOOK_TO_MX Delivered direct to MX with Outlook headers #score DOS_OUTLOOK_TO_MX 1.0 score DOS_OUTLOOK_TO_MX 3.0 ##header RCVD_IN_DSBL eval:check_rbl_txt('dsbl-notfirsthop', 'list.dsbl.org.', '(?i:dsbl)') ##describe RCVD_IN_DSBL Received via a relay in list.dsbl.org ##score RCVD_IN_DSBL 0.0 2.574 0.0 4.295 #score RCVD_IN_DSBL 0.0 1.930 0.0 3.221 ifplugin Mail::SpamAssassin::Plugin::Pyzor #full PYZOR_CHECK eval:check_pyzor() #describe PYZOR_CHECK Listed in Pyzor (http://pyzor.sf.net/) #score PYZOR_CHECK 0 2.834 0 3.700 score PYZOR_CHECK 0.0 endif #meta MISSING_MIMEOLE (__HAS_MSMAIL_PRI && !__HAS_MIMEOLE && !__HAS_SQUIRRELMAIL_IN_MAILER) #describe MISSING_MIMEOLE Message has X-MSMail-Priority, but no X-MimeOLE #score MISSING_MIMEOLE 0.068 0 0 0.012 meta MISSING_MIMEOLE (__HAS_MSMAIL_PRI && !__HAS_MIMEOLE && !__HAS_SQUIRRELMAIL_IN_MAILER) && !__CUST_X_Mailer_MSO12 score MISSING_MIMEOLE 1.5 ##header SUBJ_HAS_UNIQ_ID eval:check_for_unique_subject_id() ##describe SUBJ_HAS_UNIQ_ID Subject contains a unique ID ##score SUBJ_HAS_UNIQ_ID 0.895 0 1.387 0.190 #score SUBJ_HAS_UNIQ_ID 1.0 ##meta SUBJECT_EXCESS_QP __SUBJECT_ENCODED_QP && !__SUBJECT_NEEDS_MIME ##describe SUBJECT_EXCESS_QP Subject: quoted-printable encoded unnecessarily ##score SUBJECT_EXCESS_QP 0 #score SUBJECT_EXCESS_QP 1.5 ##meta SUBJECT_EXCESS_BASE64 __SUBJECT_ENCODED_B64 && !__SUBJECT_NEEDS_MIME ##describe SUBJECT_EXCESS_BASE64 Subject: base64 encoded encoded unnecessarily ##score SUBJECT_EXCESS_BASE64 0.782 0 1.689 0.449 #score SUBJECT_EXCESS_BASE64 1.7 #meta FROM_EXCESS_BASE64 __FROM_ENCODED_B64 && !__FROM_NEEDS_MIME #describe FROM_EXCESS_BASE64 From: base64 encoded unnecessarily #score FROM_EXCESS_BASE64 0.647 1.052 1.190 1.309 score FROM_EXCESS_BASE64 1.2 ##header SUBJECT_ENCODED_TWICE Subject:raw =~ /=\?\S+\?[BQ]\?.*=\?\S+\?[BQ]\?/i ##describe SUBJECT_ENCODED_TWICE Subject: MIME encoded twice ##score SUBJECT_ENCODED_TWICE 0.888 1.543 1.293 1.723 #score SUBJECT_ENCODED_TWICE 0.01 #meta MSGID_FROM_MTA_HEADER (__MSGID_BEFORE_RECEIVED && !__MSGID_BEFORE_OKAY) #describe MSGID_FROM_MTA_HEADER Message-Id was added by a relay #score MSGID_FROM_MTA_HEADER 0 0 0.274 0 score MSGID_FROM_MTA_HEADER 1.0 ##header __TOCC_EXISTS exists:ToCc ##meta TO_CC_NONE !__TOCC_EXISTS ##describe TO_CC_NONE No To: or Cc: header ##score TO_CC_NONE 0.139 0.134 0.123 0.131 #score TO_CC_NONE 1.0 ##header RCVD_IN_BSP_TRUSTED eval:check_rbl_txt('bsp-firsttrusted', 'sa-trusted.bondedsender.org.', '(?i:bonded)') #describe RCVD_IN_BSP_TRUSTED Sender is in Bonded Sender Program (trusted relay) #tflags RCVD_IN_BSP_TRUSTED net nice ##reuse RCVD_IN_BSP_TRUSTED #header RCVD_IN_BSP_OTHER eval:check_rbl_txt('bsp-untrusted', 'sa-other.bondedsender.org.', '(?i:bonded)') #describe RCVD_IN_BSP_OTHER Sender is in Bonded Sender Program (other relay) #tflags RCVD_IN_BSP_OTHER net nice ##reuse RCVD_IN_BSP_OTHER ### Bonded Sender: http://www.bondedsender.com/ ##score RCVD_IN_BSP_OTHER 0 -0.1 0 -0.1 ##score RCVD_IN_BSP_TRUSTED 0 -4.3 0 -4.3 #score RCVD_IN_BSP_TRUSTED 0 -1.3 0 -1.3 ##header X_LIBRARY exists:X-Library ##describe X_LIBRARY Message has X-Library header ##score X_LIBRARY 1.920 1.920 2.220 2.400 #score X_LIBRARY 1.0 1.0 1.0 1.0 ##body HTML_FONT_BIG eval:html_test('big_font') ##describe HTML_FONT_BIG HTML tag for a big font size ##score HTML_FONT_BIG 0 0.256 0 0 #score HTML_FONT_BIG 0.01 0.256 0.01 0.01 ##body HTML_FONT_INVISIBLE eval:html_test('font_invisible') ##describe HTML_FONT_INVISIBLE HTML font color is same as background ##score HTML_FONT_INVISIBLE 0 #score HTML_FONT_INVISIBLE 0.01 ## HTML shouting range ## should really be converted into a numeric function test #body HTML_SHOUTING3 eval:html_range('max_shouting','2','3') #body HTML_SHOUTING4 eval:html_range('max_shouting','3','4') #body HTML_SHOUTING5 eval:html_range('max_shouting','4','5') #body HTML_SHOUTING6 eval:html_range('max_shouting','5','6') #body HTML_SHOUTING7 eval:html_range('max_shouting','6','7') #describe HTML_SHOUTING3 HTML has very strong "shouting" markup #describe HTML_SHOUTING4 HTML has very strong "shouting" markup #describe HTML_SHOUTING5 HTML has very strong "shouting" markup #describe HTML_SHOUTING6 HTML has very strong "shouting" markup #describe HTML_SHOUTING7 HTML has very strong "shouting" markup #score HTML_SHOUTING3 0 0 0.198 0 #score HTML_SHOUTING4 0 0 0.215 0 #score HTML_SHOUTING5 0.827 0.169 1.133 0 #score HTML_SHOUTING6 0 #score HTML_SHOUTING7 0 0.121 0 0.118 #score HTML_SHOUTING3 0.01 0.01 0.198 0.01 #score HTML_SHOUTING4 0.01 0.01 0.215 0.01 #score HTML_SHOUTING5 0.827 0.169 1.133 0.01 #score HTML_SHOUTING6 0.01 #score HTML_SHOUTING7 0.01 0.121 0.01 0.118 ## multipart/alternative has very good accuracy, other multipart types are ## similar to MIME_HTML_ONLY so they don't need a separate rule #header __CTYPE_MULTIPART_ALT Content-Type =~ /multipart\/alternative/i #meta MIME_HTML_ONLY_MULTI (__CTYPE_MULTIPART_ALT && MIME_HTML_ONLY) #describe MIME_HTML_ONLY_MULTI Multipart message only has text/html MIME parts #score MIME_HTML_ONLY_MULTI 0 score MIME_HTML_ONLY_MULTI 0.01 #header __CD exists:Content-Disposition #header __CT exists:Content-Type #header __CTE exists:Content-Transfer-Encoding #header __MIME_VERSION exists:MIME-Version #header __CT_TEXT_PLAIN Content-Type =~ /^\s*text\/plain\b/i #meta MIME_HEADER_CTYPE_ONLY (!__CD && !__CTE && __CT && !__MIME_VERSION && !__CT_TEXT_PLAIN) #describe MIME_HEADER_CTYPE_ONLY 'Content-Type' found without required MIME headers #score MIME_HEADER_CTYPE_ONLY 0 0 0.182 0 score MIME_HEADER_CTYPE_ONLY 0.1 0.1 0.182 0.1 ## note: the first alternation is anchored for speed #header TO_MALFORMED To !~ /(?:^|[^\S"])(?:(?:\"[^\"]+\"|\S+)\@\S+\.\S+|^\s*.+:\s*;|^\s*\"[^\"]+\":\s*;|^\s*\([^\)]*\)\s*$|<\S+(?:\!\S+){1,}>|^\s*$)/ [if-unset: unset@unset.unset] #describe TO_MALFORMED To: has a malformed address #score TO_MALFORMED 0 score TO_MALFORMED 0.01 # ifplugin Mail::SpamAssassin::Plugin::DNSEval # header RCVD_IN_DNSWL_LOW eval:check_rbl_sub('dnswl-firsttrusted', '127.0.\d+.1') # describe RCVD_IN_DNSWL_LOW Sender listed at http://www.dnswl.org/, low trust # tflags RCVD_IN_DNSWL_LOW nice net # endif # # ifplugin Mail::SpamAssassin::Plugin::DNSEval # header RCVD_IN_DNSWL_MED eval:check_rbl_sub('dnswl-firsttrusted', '127.0.\d+.2') # describe RCVD_IN_DNSWL_MED Sender listed at http://www.dnswl.org/, medium trust # tflags RCVD_IN_DNSWL_MED nice net # endif # # ifplugin Mail::SpamAssassin::Plugin::DNSEval # header RCVD_IN_DNSWL_HI eval:check_rbl_sub('dnswl-firsttrusted', '127.0.\d+.3') # describe RCVD_IN_DNSWL_HI Sender listed at http://www.dnswl.org/, high trust # tflags RCVD_IN_DNSWL_HI nice net # endif # ## # DNSWL ## score RCVD_IN_DNSWL_LOW 0 -1 0 -1 ## score RCVD_IN_DNSWL_MED 0 -4 0 -4 ## score RCVD_IN_DNSWL_HI 0 -8 0 -8 #score RCVD_IN_DNSWL_LOW 0 -0.5 0 -0.5 #score RCVD_IN_DNSWL_MED 0 -2 0 -2 #score RCVD_IN_DNSWL_HI 0 -4 0 -4 ##score RCVD_IN_DNSWL_LOW 0 -0.7 0 -0.7 ##score RCVD_IN_DNSWL_MED 0 -2.3 0 -2.3 ##score RCVD_IN_DNSWL_HI 0 -5 0 -5 score RCVD_IN_DNSWL_LOW 0 -0.3 0 -0.3 score RCVD_IN_DNSWL_MED 0 -1 0 -1 score RCVD_IN_DNSWL_HI 0 -2 0 -2 ###{ DEAR_WINNER #body DEAR_WINNER /\bdear.{1,20}winner/i ###} DEAR_WINNER #score DEAR_WINNER 3.199 3.196 3.199 3.197 # n=2 score DEAR_WINNER 3.6 score KAM_LOTTO1 3.9 score KAM_LOTTO2 2.6 #score KAM_LOTTO3 2.6 ## note: the first alternation is anchored for speed #header TO_MALFORMED To !~ /(?:^|[^\S"])(?:(?:\"[^\"]+\"|\S+)\@\S+\.\S+|^\s*.+:\s*;|^\s*\"[^\"]+\":\s*;|^\s*\([^\)]*\)\s*$|<\S+(?:\!\S+){1,}>|^\s*$)/ [if-unset: unset@unset.unset] #describe TO_MALFORMED To: has a malformed address #score TO_MALFORMED 0.001 0.001 0.001 1.170 score TO_MALFORMED 1.0 ###{ STOCK_IMG_HTML #meta STOCK_IMG_HTML (__ANY_IMAGE_ATTACH&&__ENV_AND_HDR_FROM_MATCH&&__PART_STOCK_CID&&__HTML_IMG_ONLY) #describe STOCK_IMG_HTML Stock spam image part, with distinctive HTML ###} STOCK_IMG_HTML #score STOCK_IMG_HTML 0.000 0.001 0.000 0.001 # n=2 score STOCK_IMG_HTML 0.001 ## a.com.b.c #uri SPOOF_COM2OTH m{^https?://(?:\w+\.)+?com\.(?:\w+\.){2}}i #describe SPOOF_COM2OTH URI contains ".com" in middle #score SPOOF_COM2OTH 2.999 2.999 2.877 2.723 score SPOOF_COM2OTH 0 ## a.com.b.com #uri SPOOF_COM2COM m{^https?://(?:\w+\.)+?com\.(?:\w+\.)+?com}i #describe SPOOF_COM2COM URI contains ".com" in middle and end #score SPOOF_COM2COM 0.001 1.632 1.952 2.048 score SPOOF_COM2COM 0 ###{ RCVD_IN_BRBL_LASTEXT ifplugin Mail::SpamAssassin::Plugin::DNSEval #ifplugin Mail::SpamAssassin::Plugin::DNSEval #header RCVD_IN_BRBL_LASTEXT eval:check_rbl('brbl-lastexternal','bb.barracudacentral.org') #tflags RCVD_IN_BRBL_LASTEXT net #endif ###} RCVD_IN_BRBL_LASTEXT ifplugin Mail::SpamAssassin::Plugin::DNSEval #score RCVD_IN_BRBL_LASTEXT 0 1.644 0 1.449 # n=0 n=2 score RCVD_IN_BRBL_LASTEXT 0.4 ####{ DOS_HIGHBIT_HDRS_BODY ##meta DOS_HIGHBIT_HDRS_BODY __FROM_NEEDS_MIME && __SUBJECT_ENCODED_B64 && __FROM_ENCODED_B64 && __SUBJECT_NEEDS_MIME && __HIGHBITS ##describe DOS_HIGHBIT_HDRS_BODY Headers need encoding and body is highbit ####} DOS_HIGHBIT_HDRS_BODY ##score DOS_HIGHBIT_HDRS_BODY 2.601 3.800 2.601 3.800 #score DOS_HIGHBIT_HDRS_BODY 0 #header __freemail_replyto eval:check_freemail_replyto('replyto') #meta FREEMAIL_REPLYTO __freemail_replyto && !__freemail_safe #describe FREEMAIL_REPLYTO Reply-To/From or Reply-To/body contain different freemails #score FREEMAIL_REPLYTO 2 #score FREEMAIL_REPLYTO 3.257 2.775 1.811 2.398 score FREEMAIL_REPLYTO 0.1 #header __freemail_reply eval:check_freemail_replyto('reply') #meta FREEMAIL_REPLY __freemail_reply && !__freemail_replyto && !__freemail_safe #describe FREEMAIL_REPLY From and body contain different freemails #score FREEMAIL_REPLY 0.5 #score FREEMAIL_REPLY 2.499 2.499 1.788 1.929 score FREEMAIL_REPLY 0.1 #body __TVD_SPACE_RATIO eval:tvd_vertical_words('0','10') #meta TVD_SPACE_RATIO (__TVD_SPACE_RATIO && !__ISO_2022_JP_DELIM && !__SUBJECT_UTF8_B_ENCODED && !__HIGHBITS) #score TVD_SPACE_RATIO 0.001 score TVD_SPACE_RATIO 0.001 #meta RDNS_NONE (__RDNS_NONE && !__CGATE_RCVD && !__DOMINO_RCVD) #describe RDNS_NONE Delivered to internal network by a host with no rDNS #score RDNS_NONE 2.399 1.274 1.228 0.793 #score RDNS_NONE 0.1 #header INVALID_DATE Date !~ /^\s*(?:(?i:Mon|Tue|Wed|Thu|Fri|Sat|Sun),\s)?\s*(?:[12]\d|3[01]|0?[1-9])\s+(?i:Jan|Feb|Ma[ry]|Apr|Ju[nl]|Aug|Sep|Oct|Nov|Dec)\s+(?:19[7-9]\d|2\d{3})\s+(?:[01]?\d|2[0-3])\:[0-5]\d(?::(?:[0-5]\d|60))?(?:\s+[AP]M)?(?:\s+(?:[+-][0-9]{4}|UT|[A-Z]{2,3}T|0000 GMT|"GMT"))?(?:\s*\(.*\))?\s*$/ [if-unset: Wed, 31 Jul 2002 16:41:57 +0200] #describe INVALID_DATE Invalid Date: header (not RFC 2822) #score INVALID_DATE 1.701 0.432 1.200 1.096 score INVALID_DATE 2.0 #meta TO_NO_BRKTS_NORDNS_HTML __TO_NO_ARROWS_R && !__TO_UNDISCLOSED && RDNS_NONE && MIME_HTML_ONLY && !__MIME_QP && !__MSGID_JAVAMAIL && !__REPLYTO_EXISTS && !__MSGID_BEFORE_RECEIVED && !__VIA_ML && !__UA_MUTT && !__FROM_FREEMAIL && !__HAS_X_MAILER && !__COMMENT_EXISTS && !__HTML_LENGTH_384 ##score TO_NO_BRKTS_NORDNS_HTML 0.20 #describe TO_NO_BRKTS_NORDNS_HTML To: misformatted and no rDNS and HTML only #score TO_NO_BRKTS_NORDNS_HTML 0.399 1.268 0.399 1.268 score TO_NO_BRKTS_NORDNS_HTML 1.3 ifplugin Mail::SpamAssassin::Plugin::SPF #header SPF_SOFTFAIL eval:check_for_spf_softfail() #describe SPF_SOFTFAIL SPF: sender does not match SPF record (softfail) #tflags SPF_SOFTFAIL net #reuse SPF_SOFTFAIL score SPF_SOFTFAIL 2.0 endif # Mail::SpamAssassin::Plugin::SPF ###{ MIXED_ES if can(Mail::SpamAssassin::Conf::feature_bug6558_free) ifplugin Mail::SpamAssassin::Plugin::ReplaceTags # #if can(Mail::SpamAssassin::Conf::feature_bug6558_free) # ifplugin Mail::SpamAssassin::Plugin::ReplaceTags # meta MIXED_ES ( ! HTML_IMAGE_ONLY_16 ) && ( __LOWER_E > 20 ) && ( __E_LIKE_LETTER > ( (__LOWER_E * 14 ) / 10) ) && ( __E_LIKE_LETTER < ( 10 * __LOWER_E ) ) # describe MIXED_ES Too many es are not es # tflags MIXED_ES publish #score MIXED_ES 3.800 3.281 3.800 3.281 score MIXED_ES 1.0 #endif #endif ###} MIXED_ES if can(Mail::SpamAssassin::Conf::feature_bug6558_free) ifplugin Mail::SpamAssassin::Plugin::ReplaceTags