# SpamAssassin rules file. # # The format is easy to grok: # # header SYMBOLIC_TEST_NAME header op pattern # (The operations allowed (so far) are: =~ and: !~) # # header SYMBOLIC_TEST_NAME eval:name_of_eval_method([args]) # # describe SYMBOLIC_TEST_NAME Textual description of test # # body SYMBOLIC_TEST_NAME /pattern/modifiers # (evaluated for each text or HTML line in the message body) # # body SYMBOLIC_TEST_NAME eval:name_of_eval_method([args]) # (this is evaluated for the entire message, not for each line) # # # starts a comment, whitespace is not significant. # ########################################################################### header NO_REAL_NAME From =~ /^\s*\?\s*$/ describe NO_REAL_NAME From: does not include a real name header FROM_ENDS_IN_NUMS From =~ /\d+\@/ describe FROM_ENDS_IN_NUMS From: ends in numbers header PLING_PLING Subject =~ /\!+/ describe PLING_PLING Subject has lots of exclamation marks header SUBJ_HAS_UNIQ_ID Subject =~ /\s+(?:\s{6,}[-a-z0-9]{4,}|[-:\#$\[]+[-a-zA-Z0-9]{4,}[\]$]+|[-:\#][-a-zA-Z0-9]{4,})$/ describe SUBJ_HAS_UNIQ_ID Subject contains a unique ID number header UNDISC_RECIPS To =~ /Undisclosed.*Recipients/i describe UNDISC_RECIPS To "Undisclosed.Recipients" or similar header SUBJ_ALL_CAPS Subject !~ /[a-z]/ describe SUBJ_ALL_CAPS Subject is all capitals header MSGID_HAS_NO_AT Message-Id !~ /\@/ describe MSGID_HAS_NO_AT Message-Id has no @ sign header INVALID_DATE Date =~ / AM| PM/ describe INVALID_DATE Invalid Date: header header SUBJ_HAS_Q_MARK Subject =~ /\?/ describe SUBJ_HAS_Q_MARK Subject: ends in a question mark header ADVERT_CODE Subject =~ /ADV:/ describe ADVERT_CODE Subject: contains advertising tag header FRIEND_AT_PUBLIC To =~ /(yourdomain|you|your|public).(com|org|net)/i describe FRIEND_AT_PUBLIC sent to you@you.com or similar header TO_EMPTY To =~ /^(?:\@|\s*$)/ describe TO_EMPTY To: is empty header REPLY_TO_EMPTY Reply-To =~ /^\@/ describe REPLY_TO_EMPTY Reply-To: is empty header NO_MX_FOR_FROM eval:check_for_from_mx() describe NO_MX_FOR_FROM No MX records for the From: domain header KNOWN_BAD_DIALUPS eval:check_for_bad_dialup_ips() describe KNOWN_BAD_DIALUPS Received via known spam-harbouring dialups header FROM_AND_TO_SAME eval:check_for_from_to_equivalence() describe FROM_AND_TO_SAME From and To the same address header BAD_HELO_WARNING eval:check_for_bad_helo() describe BAD_HELO_WARNING Fake name used in SMTP HELO command header SUBJ_FULL_OF_8BITS eval:check_subject_for_lotsa_8bit_chars() describe SUBJ_FULL_OF_8BITS Subject is full of 8-bit characters header RCVD_IN_RBL eval:check_rbl('rbl.maps.vix.com') describe RCVD_IN_RBL Received via a relay listed in the RBL header RCVD_IN_RELAYS_ORBS_ORG eval:check_rbl('relays.orbs.org') describe RCVD_IN_RELAYS_ORBS_ORG Received via a relay in relays.orbs.org header RCVD_IN_MAIL_ABUSE_ORG eval:check_rbl('relays.mail-abuse.org') describe RCVD_IN_MAIL_ABUSE_ORG Received via a relay in relays.mail-abuse.org ########################################################################### body REMOVE_SUBJ /remove.*subject/i body SUBJ_REMOVE /subject.*remove/i body REPLY_REMOVE_SUBJECT /reply.*remove.*subject/i body MAILTO_WITH_SUBJ_REMOVE /mailto:.*\?subject=.*remove/i body MAILTO_WITH_SUBJ /mailto:.*\?subject=/i body REMOVE_IN_QUOTES /\"remove\"/i body JAVASCRIPT /