2017-09-19 09:19:22 +02:00
|
|
|
MX_IMPLICIT {
|
2018-12-10 14:26:18 +02:00
|
|
|
expression = "MX_GOOD & MX_MISSING";
|
2017-12-09 10:08:18 +02:00
|
|
|
score = -0.01;
|
|
|
|
}
|
|
|
|
VIRUS_FOUND {
|
|
|
|
expression = "CLAM_VIRUS & !MAILCOW_WHITE";
|
|
|
|
score = 2000;
|
2017-09-19 09:19:22 +02:00
|
|
|
}
|
2018-01-16 22:02:45 +02:00
|
|
|
SPF_FAIL_NO_DKIM {
|
2019-09-23 10:44:26 +02:00
|
|
|
expression = "R_SPF_FAIL & R_DKIM_NA & !MAILCOW_WHITE & !ARC_ALLOW";
|
2018-01-16 22:02:45 +02:00
|
|
|
score = 10;
|
|
|
|
}
|
2018-12-10 14:26:18 +02:00
|
|
|
SOGO_CONTACT_EXCLUDE_FWD_HOST {
|
2019-11-11 09:20:46 +02:00
|
|
|
expression = "-WHITELISTED_FWD_HOST & ~SOGO_CONTACT";
|
2018-12-10 14:26:18 +02:00
|
|
|
}
|
|
|
|
SOGO_CONTACT_SPOOFED {
|
2019-01-13 11:28:21 +02:00
|
|
|
expression = "(R_SPF_PERMFAIL | R_SPF_SOFTFAIL | R_SPF_FAIL) & ~SOGO_CONTACT";
|
2018-12-10 14:26:18 +02:00
|
|
|
}
|
2020-07-02 07:53:22 +02:00
|
|
|
# SPF checks against envelope, so we do not exclude SPF valid mail
|
2019-04-14 20:37:38 +02:00
|
|
|
SPOOFED_UNAUTH {
|
2020-07-29 13:57:33 +02:00
|
|
|
expression = "!MAILCOW_AUTH & !MAILCOW_WHITE & !RSPAMD_HOST & !SIEVE_HOST & MAILCOW_DOMAIN_HEADER_FROM & !WHITELISTED_FWD_HOST";
|
2019-04-14 20:37:38 +02:00
|
|
|
score = 5.0;
|
|
|
|
}
|
2019-06-25 18:52:05 +02:00
|
|
|
# Only apply to inbound unauthed and not whitelisted
|
2019-06-16 17:35:24 +02:00
|
|
|
OLEFY_MACRO {
|
|
|
|
expression = "!MAILCOW_AUTH & !MAILCOW_WHITE & OLETOOLS";
|
2019-06-20 10:18:43 +02:00
|
|
|
score = 20.0;
|
2019-06-16 17:35:24 +02:00
|
|
|
policy = "remove_weight";
|
|
|
|
}
|
2019-08-28 13:03:15 +02:00
|
|
|
BAD_WORD_BAD_TLD {
|
2019-09-15 11:16:30 +02:00
|
|
|
expression = "FISHY_TLD & ( BAD_WORDS | BAD_WORDS_DE )"
|
2019-08-30 19:30:38 +02:00
|
|
|
score = 10.0;
|
2019-08-28 13:03:15 +02:00
|
|
|
}
|
2019-11-24 17:08:58 +02:00
|
|
|
FORGED_W_BAD_POLICY {
|
2020-05-23 11:16:33 +02:00
|
|
|
expression = "( ~g+:policies | ~R_SPF_NA) & ( ~FROM_NEQ_ENVFROM & ~FORGED_SENDER ) & !WHITELISTED_FWD_HOST"
|
2019-11-24 17:08:58 +02:00
|
|
|
score = 3.0;
|
|
|
|
}
|
2020-02-04 13:35:52 +02:00
|
|
|
RBL_EXCLUDE_FWD_HOST {
|
|
|
|
expression = "-WHITELISTED_FWD_HOST & ^g:rbl"
|
|
|
|
}
|
2020-05-23 20:32:56 +02:00
|
|
|
SPF_EXCLUDE_FWD_HOST {
|
|
|
|
expression = "-WHITELISTED_FWD_HOST & (^R_SPF_PERMFAIL | ^R_SPF_SOFTFAIL | ^R_SPF_FAIL)"
|
2020-05-23 11:16:33 +02:00
|
|
|
}
|
|
|
|
HFILTER_EXCLUDE_FWD_HOST {
|
|
|
|
expression = "-WHITELISTED_FWD_HOST & ^g:hfilter"
|
|
|
|
}
|
2020-05-23 12:20:57 +02:00
|
|
|
NEURAL_EXCLUDE_FWD_HOST {
|
|
|
|
expression = "-WHITELISTED_FWD_HOST & ^g:neural"
|
2020-05-23 11:16:33 +02:00
|
|
|
}
|
2020-04-10 20:54:26 +02:00
|
|
|
UPSTREAM_CHECKS_EXCLUDE_FWD_HOST {
|
2020-04-27 20:48:12 +02:00
|
|
|
expression = "(-SIEVE_HOST | -WHITELISTED_FWD_HOST) & (^UNITEDINTERNET_SPAM | ^SPAM_FLAG | ^KLMS_SPAM | ^AOL_SPAM | ^MICROSOFT_SPAM)"
|
2020-04-10 20:54:26 +02:00
|
|
|
}
|
2020-05-06 20:15:18 +02:00
|
|
|
SPOOFED_UNAUTH_POLICY_FAILURE {
|
|
|
|
expression = "-SPOOFED_UNAUTH & -R_SPF_FAIL";
|
|
|
|
score = 50.0;
|
|
|
|
}
|