# SpamAssassin rules file

rawbody  LONGLINE	/^.{998}.+\r?$/
describe LONGLINE	Line length exceeds 998 character limit, RFC 5322

header   RP_8BIT	Return-Path:raw =~ /[^\000-\177]/
describe RP_8BIT	Return-Path contains 8-bit characters with high bit on

header   RP_LASTNAME	Return-Path =~ /LAST_NAME/m
describe RP_LASTNAME	Return-Path says LAST_NAME literally

header   RP_UNDERLINE	Return-Path:addr =~ /^_/m
describe RP_UNDERLINE	Return-Path address starts with an underline

header   RP_MINUS	Return-Path:addr =~ /^-/m
describe RP_MINUS	Return-Path address starts with a minus

header   CR_IN_SUBJ	Subject:raw =~ /\015/
describe CR_IN_SUBJ	Subject contains a CR character

# must use :raw to avoid seeing a decoded display name
header   FROM_UNBAL1	From:raw =~ / < [^>]* $/xm
describe FROM_UNBAL1	From with unbalanced angle brackets, '>' missing

header   FROM_UNBAL2	From:raw =~ /^ [^<]* > /xm
describe FROM_UNBAL2	From with unbalanced angle brackets, '<' missing

header   FROM_WSP_TRAIL	From:raw =~ /< [^>]* \s > [^<>]* \z/xm
describe FROM_WSP_TRAIL	Trailing whitespace before '>' in From header field

header   FROM_WSP_LEAD 	From:raw =~ /< \s+ [^>\s] [^>]* > [^<>]* \z/xm
describe FROM_WSP_LEAD	Leading whitespace after '<' in From header field

header   MSGID_WSP_TRAIL Message-ID:raw =~ /< [^>]* \s > [^<>]* \z/xm
describe MSGID_WSP_TRAIL Trailing whitespace before '>' in Message-ID header

header   MSGID_NOFQDN1  Message-ID =~ /<[^\@]*>/m
describe MSGID_NOFQDN1  Message-ID with no domain name
header   MSGID_NOFQDN2  Message-ID =~ /<.*\@[A-Za-z0-9]+>/m
describe MSGID_NOFQDN2  Message-ID without a fully-qualified domain name

#score   LONGLINE	0.5
#score   RP_8BIT	2.8
#score   RP_LASTNAME	4
#score   RP_UNDERLINE	3
#score   RP_MINUS	2
#score   CR_IN_SUBJ	4
#score   FROM_UNBAL1	3
#score   FROM_UNBAL2	3
#score   FROM_WSP_TRAIL 2
#score   FROM_WSP_LEAD	2
#score   MSGID_WSP_TRAIL 2
#score   MSGID_NOFQDN1	1
#score   MSGID_NOFQDN2	1