#
#header		REPLYTO_MANY_AT	Reply-To =~ /\@.+\@/
#describe	REPLYTO_MANY_AT	More than one @ in Reply-To:
#
#header		SENDER_MANY_AT	Sender =~ /\@.+\@/
#describe	SENDER_MANY_AT	More than one @ in Sender:
#
#header		FROM_MANY_AT	From =~ /\@.+\@/
#describe	FROM_MANY_AT	More than one @ in From:
#

header         RDNS_LOCALHOST  X-Spam-Relays-External =~ /^\[ ip=(?!127)\d+\.\d+\.\d+\.\d+ rdns=localhost(?:\.localdomain)? /i
describe       RDNS_LOCALHOST  Sender's public rDNS is "localhost"

#body		EU_SPAM_LAW	m,Directive 2000/31/EC of the European Parliament,i
#describe	EU_SPAM_LAW	Quoting "European Parliament" spam law

ifplugin Mail::SpamAssassin::Plugin::MIMEHeader
  mimeheader   HTML_ATTACH    Content-Type =~ m,text/html;.+\.html?\b,i

  mimeheader   OBFU_TEXT_ATTACH    Content-Type =~ m,application/octet-stream;.+\.txt\b,i
endif

header         MUA_ONE_WORD       X-Mailer =~ /^[a-z]+$/i
describe       MUA_ONE_WORD       Single word X-Mailer:

body           DEAR_BENEFICIARY		/^Dear\sBeneficiary\b/i
describe       DEAR_BENEFICIARY		Dear Beneficiary:

uri            URI_NUMERIC_CCTLD     m;^[a-z]+://(?:\d+\.){2,}[a-z][a-z]/;i
describe       URI_NUMERIC_CCTLD     CCTLD URI with multiple numeric subdomains

header         FROM_MISSPACED        From =~ /\S"</
describe       FROM_MISSPACED        From: missing whitespace

header         MIME_BDRY_0D0D        Content-Type =~ /boundary=\S+(?:0[1-9]){10,}/
describe       MIME_BDRY_0D0D        Suspicious MIME boundary string

header         MUA_EQ_ORG         ALL =~ /\nX-Mailer: ([^\n]+)\n.*Organization: \1/sm
describe       MUA_EQ_ORG         X-Mailer: same as Organization: