mailcow-dockerized/data/conf/rspamd/local.d/multimap.conf

RCPT_MAILCOW_DOMAIN {
  type = "rcpt";
  filter = "email:domain";
  map = "redis://DOMAIN_MAP";
  symbols_set = ["RCPT_MAILCOW_DOMAIN"];
}

WHITELISTED_FWD_HOST {
  type = "ip";
  map = "redis://WHITELISTED_FWD_HOST";
  symbols_set = ["WHITELISTED_FWD_HOST"];
}

BULK_HEADER {
  type = "content";
  map = "${LOCAL_CONFDIR}/custom/bulk_header.map";
  filter = "headers"
  regexp = true;
  symbols_set = ["BULK_HEADER"];
}

BAD_HEADER {
  type = "content";
  map = "${LOCAL_CONFDIR}/custom/bad_header.map";
  filter = "headers"
  regexp = true;
  symbols_set = ["BAD_HEADER"];
}

LOCAL_BL_ASN {
  require_symbols = "!MAILCOW_WHITE";
  type = "asn";
  map = "${LOCAL_CONFDIR}/custom/bad_asn.map";
  score = 5;
  description = "Sender's ASN is on the local blacklist";
  symbols_set = ["LOCAL_BL_ASN"];
}

GLOBAL_SMTP_FROM_WL {
  type = "from";
  map = "${LOCAL_CONFDIR}/custom/global_smtp_from_whitelist.map";
  regexp = true;
  score = -2050;
}

GLOBAL_SMTP_FROM_BL {
  type = "from";
  map = "${LOCAL_CONFDIR}/custom/global_smtp_from_blacklist.map";
  regexp = true;
  score = 2050;
}

GLOBAL_MIME_FROM_WL {
  type = "header";
  header = "from";
  filter = "email:addr";
  map = "${LOCAL_CONFDIR}/custom/global_mime_from_whitelist.map";
  regexp = true;
  score = -2050;
}

GLOBAL_MIME_FROM_BL {
  type = "header";
  header = "from";
  filter = "email:addr";
  map = "${LOCAL_CONFDIR}/custom/global_mime_from_blacklist.map";
  regexp = true;
  score = 2050;
}

GLOBAL_RCPT_WL {
  type = "rcpt";
  map = "${LOCAL_CONFDIR}/custom/global_rcpt_whitelist.map";
  regexp = true;
  prefilter = true;
  action = "accept";
}

GLOBAL_RCPT_BL {
  type = "rcpt";
  map = "${LOCAL_CONFDIR}/custom/global_rcpt_blacklist.map";
  regexp = true;
  prefilter = true;
  action = "reject";
}

SIEVE_HOST {
  type = "ip";
  map = "${LOCAL_CONFDIR}/custom/dovecot_trusted.map";
  symbols_set = ["SIEVE_HOST"];
}

RSPAMD_HOST {
  type = "ip";
  map = "${LOCAL_CONFDIR}/custom/rspamd_trusted.map";
  symbols_set = ["RSPAMD_HOST"];
}

MAILCOW_DOMAIN_HEADER_FROM { 
  type = "header";  
  header = "from";  
  filter = "email:domain";  
  map = "redis://DOMAIN_MAP"; 
}

IP_WHITELIST {
  type = "ip";
  map = "${LOCAL_CONFDIR}/custom/ip_wl.map";
  symbols_set = ["IP_WHITELIST"];
  score = -2050;
}

FISHY_TLD {
  type = "from";
  filter = "email:domain";
  map = "${LOCAL_CONFDIR}/custom/fishy_tlds.map";
  regexp = true;
  score = 0.1;
}

BAD_WORDS {
  type = "content";
  filter = "text";
  map = "${LOCAL_CONFDIR}/custom/bad_words.map";
  regexp = true;
  score = 0.1;
}

BAD_WORDS_DE {
  type = "content";
  filter = "text";
  map = "${LOCAL_CONFDIR}/custom/bad_words_de.map";
  regexp = true;
  score = 0.1;
}

BAD_LANG {
  type = 'selector';
  selector = 'languages';
  map = "${LOCAL_CONFDIR}/custom/bad_languages.map";
  symbols_set = ["LANG_FILTER"];
  regexp = true;
  score = 5.0;
}

BAZAAR_ABUSE_CH {
  type = "selector";
  selector = "attachments(hex,md5)";
  map = "https://bazaar.abuse.ch/export/txt/md5/recent/";
  score = 10.0;
}

URLHAUS_ABUSE_CH {
  type = "url";
  filter = "full";
  map = "https://urlhaus.abuse.ch/downloads/text_online/";
  score = 10.0;
}

SMTP_LIMITED_ACCESS {
  type = "user";
  map = "redis://SMTP_LIMITED_ACCESS";
  symbols_set = ["SMTP_LIMITED_ACCESS"];
}

BAD_SUBJECT_00 {
  type = "header";
  header = "subject";
  regexp = true;
  map = "http://nullnull.org/bad-subject-regex.txt";
  score = 20.0;
  symbols_set = ["BAD_SUBJECT_00"];
}