1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
| | # raise or lower as needed
required_score 3.0
# do not mess with the original message body, only notify in headers
clear_report_template
clear_unsafe_report_template
report_safe 0
# we do not use nor support this on NFS
lock_method flock
# do not throw off Bayes
bayes_ignore_header X-Bogosity
bayes_ignore_header X-Spam-Flag
bayes_ignore_header X-Spam-Status
bayes_ignore_header X-Spam-Report
# English-only for all lists on public-inbox.org
ok_locales en
# we have "loadplugin Mail::SpamAssassin::Plugin::TextCat" in a *.pre file
ok_languages en
# uncomment the following for importing archives:
# dns_available no
# skip_rbl_checks 1
# skip_uribl_checks 1
# manual rules (some stolen from debian)
# these require "allow_user_rules 1" in the system-wide config
rawbody LOCAL_VIEWINBROWSER /View this message in a browser/
describe LOCAL_VIEWINBROWSER "HTML mail not welcome"
score LOCAL_VIEWINBROWSER 2.8
body MEETUPSECURELY /meetupsecurely\.com/i
describe MEETUPSECURELY "site used by spammers"
score MEETUPSECURELY 2.8
body HELLOMYDEAR /hello my dear/i
describe HELLOMYDEAR "spam phrase"
score HELLOMYDEAR 2.8
body JUSTAMAILBOX /I'm just a mailbox used for sending notifications/
describe JUSTAMAILBOX "autoreply phrase"
score JUSTAMAILBOX 5.0
# hello foo
header PI_HELLO subject =~ /^hello \w+/i
describe PI_HELLO "Hello foo"
score PI_HELLO 3
# no delivery
header PI_DNOT subject =~ /delivery\s+(?:status\s+)?notification/i
describe PI_DNOT "delivery notification"
score PI_DNOT 3
# no delivery
header PI_PARCEL subject =~ /could not deliver your parcel/
describe PI_PARCEL "delivery notification"
score PI_PARCEL 3
# notice to appear
header PI_DNOTICE subject =~ /notice to appear/i
describe PI_DNOTICE "notice to appear"
score PI_DNOTICE 3
full ZIPFILE /\b(?:file)?name\=.*\.zip\b/i
describe ZIPFILE zipfile attachment
score ZIPFILE 1.5
header PI_NUM_WORD_SUBJ subject =~ /^\d+ [a-z0-9_-]+$/
describe PI_NUM_WORD_SUBJ "number and single word subject"
score PI_NUM_WORD_SUBJ 0.5
header PI_NUM_ONLY_SUBJ subject =~ /^\d+$/
describe PI_NUM_ONLY_SUBJ "number only subject"
score PI_NUM_ONLY_SUBJ 0.5
header PI_IMPORTANCE_HIGH importance =~ /^high$/
describe PI_IMPORTANCE_HIGH "importance: high header"
score PI_IMPORTANCE_HIGH 0.5
meta PI_ZIPFILE_NUM_WORD_SUBJ PI_NUM_WORD_SUBJ && ZIPFILE
describe PI_ZIPFILE_NUM_WORD_SUBJ "common spam/virus pattern"
score PI_ZIPFILE_NUM_WORD_SUBJ 3
meta PI_ZIPFILE_NUM_ONLY_SUBJ PI_NUM_ONLY_SUBJ && ZIPFILE
describe PI_ZIPFILE_NUM_ONLY_SUBJ "common spam/virus pattern"
score PI_ZIPFILE_NUM_ONLY_SUBJ 3
full DOCFILE /\b(?:file)?name\=.*\.doc\b/i
describe DOCFILE doc attachment
score DOCFILE 3
score BAYES_999 3
score BAYES_05 -1.5
score BAYES_00 -3
# trust paid whitelist services? never
score RCVD_IN_RP_SAFE 0.0
score RCVD_IN_RP_CERTIFIED 0.0
# this depends on PublicInbox::SaPlugin::ListMirror:
# header LIST_MIRROR_RECEIVED eval:check_list_mirror_received()
# describe LIST_MIRROR_RECEIVED Received does not match expected
# score LIST_MIRROR_RECEIVED 10
#
# this depends on PublicInbox::SaPlugin::ListMirror:
# header LIST_MIRROR_BCC eval:check_list_mirror_bcc()
# describe LIST_MIRROR_BCC Mailing list was Bcc-ed
# score LIST_MIRROR_BCC 10
# list_mirror X-Mailing-List git@vger.kernel.org *.kernel.org git@vger.kernel.org
# DNSWL scores is a bit too powerful by default (-5 adjustment!)
# default score RCVD_IN_DNSWL_LOW 0 -0.7 0 -0.7
# default score RCVD_IN_DNSWL_MED 0 -2.3 0 -2.3
# default score RCVD_IN_DNSWL_HI 0 -5 0 -5
score RCVD_IN_DNSWL_MED 0 -0.1 0 -0.1
score RCVD_IN_DNSWL_HI 0 -0.2 0 -0.2
|