# SpamAssassin rules file: known non-spam mailers ("ratware")
#
# Please don't modify this file as your changes will be overwritten with
# the next update. Use @@LOCAL_RULES_DIR@@/local.cf instead.
# See 'perldoc Mail::SpamAssassin::Conf' for details.
#
###########################################################################

## If a USER_AGENT rule is added, make sure to modify the USER_AGENT rule to counter.

header USER_AGENT_PINE		Message-Id =~ /^<Pine\.[A-Z]{3}\.\d\.[0-9A-Z]+\./
describe USER_AGENT_PINE	Message-Id indicates a non-spam MUA (Pine)

# From 0.93.2 - 1.2.5.1, message-id is:
#  snprintf (buf, sizeof (buf), "<%d%02d%02d%02d%02d%02d.%c%d@%s>",
#            tm->tm_year + 1900, tm->tm_mon + 1, tm->tm_mday, tm->tm_hour,
#            tm->tm_min, tm->tm_sec, MsgIdPfx, getpid (), fqdn);
#  MsgIdPfx = (MsgIdPfx == 'Z') ? 'A' : MsgIdPfx + 1;
# The code from mutt 1.4 is adds a 'G' for some reason:
#  snprintf (buf, sizeof (buf), "<%d%02d%02d%02d%02d%02d.G%c%d@%s>",
header __VALID_MUTT_MSGID	Message-Id =~ /^<[1-9]\d{3}[01]\d[0-3]\d[0-2]\d(?:[0-5]\d){2}\.G?[A-Z]\d+\@[a-zA-Z0-9._-]+>$/
header __USER_AGENT_MUTT	User-Agent =~ m@^Mutt/\d(?:\.\d+){1,4}@
meta USER_AGENT_MUTT		__USER_AGENT_MUTT && __VALID_MUTT_MSGID
describe USER_AGENT_MUTT	User-Agent header indicates a non-spam MUA (Mutt)

header USER_AGENT_MOZILLA_UA	User-Agent =~ /^Mozilla\/5\.\d+ \(.*\) Gecko\/\d{8}(?: |$)/
describe USER_AGENT_MOZILLA_UA	User-Agent header indicates a non-spam MUA (Mozilla)
header USER_AGENT_MOZILLA_XM	X-Mailer   =~ /^Mozilla 4\.\d{2} \[[a-z]{2}\]/
describe USER_AGENT_MOZILLA_XM	X-Mailer header indicates a non-spam MUA (Netscape)

header USER_AGENT_MACOE		User-Agent =~ /^Microsoft[ -]Outlook[ -]Express[ -]Macintosh[ -]Edition/
describe USER_AGENT_MACOE	User-Agent header indicates a non-spam MUA (Outlook Express)

header USER_AGENT_ENTOURAGE	User-Agent =~ /^Microsoft-Entourage\/\d{1,2}(?:\.\d){1,2}\.\d{4}$/
describe USER_AGENT_ENTOURAGE	User-Agent header indicates a non-spam MUA (Entourage)

header USER_AGENT_KMAIL		User-Agent =~ /^KMail\/1\.\d\.\d+$/
describe USER_AGENT_KMAIL	User-Agent header indicates a non-spam MUA (KMail)

header USER_AGENT_IMP		User-Agent =~ /^Internet Messaging Program \(IMP\) [34]\.\d/
describe USER_AGENT_IMP		User-Agent header indicates a non-spam MUA (IMP)

header USER_AGENT_TONLINE	X-Mailer   =~ /^T-Online (?:e|Web)Mail \d\.\d+$/
describe USER_AGENT_TONLINE	X-Mailer header indicates a non-spam MUA (T-Offline)

header USER_AGENT_APPLEMAIL	X-Mailer   =~ /^Apple Mail \(\d\.\d+\)$/
describe USER_AGENT_APPLEMAIL	X-Mailer header indicates a non-spam MUA (Apple Mail)

header USER_AGENT_GNUS_UA	User-Agent =~ /^Gnus\/\d\.\d+ /
describe USER_AGENT_GNUS_UA	User-Agent header indicates a non-spam MUA (Gnus)
header USER_AGENT_GNUS_XM	X-Mailer   =~ /^Gnus v\d(?:\.\d+){1,2}\/X?Emacs \d+\.\d+/
describe USER_AGENT_GNUS_XM	X-Mailer header indicates a non-spam MUA (Gnus)

header USER_AGENT_VM		X-Mailer =~ /^\s*VM\s+\d+\.\d+\s+under\s+.{0,30}?[Ee]macs\b/
describe USER_AGENT_VM		X-Mailer header indicates a non-spam MUA (VM)

# frequently forged, needs some correlation meta checks with other headers.
header __USER_AGENT_MSN		X-Mailer =~ /^MSN Explorer /
header __HAS_XOAT		X-Originalarrivaltime =~ /FILETIME/
header __HAS_XOIP		X-Originating-Ip =~ /^\[/
meta USER_AGENT_MSN		(__USER_AGENT_MSN && __HAS_XOAT && __HAS_XOIP)
describe USER_AGENT_MSN		Headers indicate valid mail from MSN

header USER_AGENT_FORTE		X-Mailer =~ /^Forte Agent \d\.\d+\/\d+\.\d+$/
describe USER_AGENT_FORTE	X-Mailer header indicates a non-spam MUA (Forte)

tflags USER_AGENT_PINE		nice
tflags USER_AGENT_MUTT		nice
tflags USER_AGENT_MOZILLA_UA	nice
tflags USER_AGENT_MOZILLA_XM	nice
tflags USER_AGENT_MACOE		nice
tflags USER_AGENT_ENTOURAGE	nice
tflags USER_AGENT_KMAIL		nice
tflags USER_AGENT_IMP		nice
tflags USER_AGENT_TONLINE	nice
tflags USER_AGENT_APPLEMAIL	nice
tflags USER_AGENT_GNUS_UA	nice
tflags USER_AGENT_GNUS_XM	nice
tflags USER_AGENT_VM		nice
tflags USER_AGENT_MSN		nice
tflags USER_AGENT_FORTE		nice

header __XIMIAN_MUA		X-Mailer =~ /^(?:Ximian Evolution|Evolution\/\d+\.)/
# interestingly the last word (\S+) always seems to be 'camel' ;)
header __XIMIAN_MSGID		MESSAGEID =~ /^<\d{10}\.\d+\.\d+\.\S+\@/
meta USER_AGENT_XIMIAN		(__XIMIAN_MSGID && __XIMIAN_MUA && !__UNUSABLE_MSGID)
describe USER_AGENT_XIMIAN	Headers indicate a non-spam MUA (Ximian)
tflags USER_AGENT_XIMIAN	nice