#testrules
header   __FSL_RELAY_GOOGLE	X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+\.google\.com /i
header   __FSL_ENVFROM_GOOGLE	X-Spam-Relays-External =~ /^[^\]]+ envfrom=[^\@ ]+\@g(?:mail|oogle)\.com /i
meta     FSL_NOT_FROM_GOOGLE	__FSL_ENVFROM_GOOGLE && !__FSL_RELAY_GOOGLE
score    FSL_NOT_FROM_GOOGLE	2.0
describe FSL_NOT_FROM_GOOGLE    Envelope-From GMail or Google but not originated from Google systems

header   __FSL_RELAY_YAHOO      X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+\.yahoo(?:dns)?\.co(?:m|\.jp) /i
header   __FSL_ENVFROM_YAHOO    X-Spam-Relays-External =~ /^[^\]]+ envfrom=[^\@ ]+\@yahoo(?:groups)?\./i
header   __FSL_ENVFROM_YMAIL    X-Spam-Relays-External =~ /^[^\]]+ envfrom=[^\@ ]+\@ymail\.com /i
header   __FSL_ENVFROM_ROCKET   X-Spam-Relays-External =~ /^[^\]]+ envfrom=[^\@ ]+\@rocketmail\.com /i
meta     FSL_NOT_FROM_YAHOO     ((__FSL_ENVFROM_YAHOO || __FSL_ENVFROM_YMAIL || __FSL_ENVFROM_ROCKET) && !__FSL_RELAY_YAHOO)
score    FSL_NOT_FROM_YAHOO     2.0
describe FSL_NOT_FROM_YAHOO     Envelope-From Yahoo or Yahoo Groups but not originated from Yahoo systems

header   __FSL_RELAY_HOTMAIL    X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+\.hotmail\.com /i
header   __FSL_ENVFROM_HOTMAIL  X-Spam-Relays-External =~ /^[^\]]+ envfrom=[^\@ ]+\@hotmail\./i
header   __FSL_ENVFROM_LIVE     X-Spam-Relays-External =~ /^[^\]]+ envfrom=[^\@ ]+\@live\./i
meta     FSL_NOT_FROM_HOTMAIL   (__FSL_ENVFROM_HOTMAIL || __FSL_ENVFROM_LIVE) && !__FSL_RELAY_HOTMAIL
score    FSL_NOT_FROM_HOTMAIL   2.0
describe FSL_NOT_FROM_HOTMAIL   Envelope-From Hotmail/Live but not originated from Hotmail systems

header   __FSL_RELAY_AOL        X-Spam-Relays-External =~ /^[^\]]+ rdns=[^ ]+\.aol\.com/i
header   __FSL_ENVFROM_AOL      X-Spam-Relays-External =~ /^[^\]]+ envfrom=[^\@ ]+\@aol\./i
meta     FSL_NOT_FROM_AOL       __FSL_ENVFROM_AOL && !__FSL_RELAY_AOL
score    FSL_NOT_FROM_AOL       2.0
describe FSL_NOT_FROM_AOL       Envelope-From AOL but not originated from AOL systems

header   FSL_UNDISCLOSED_RCPTS  To =~ /\bundisclosed[- ]recipients\b/i
score    FSL_UNDISCLOSED_RCPTS  0.01
describe FSL_UNDISCLOSED_RCPTS  To undisclosed recipients

header   FSL_ABUSED_WEB_1       exists:X-AntiAbuse
score    FSL_ABUSED_WEB_1       0.01
describe FSL_ABUSED_WEB_1       Has X-AntiAbuse header

header   FSL_ABUSED_WEB_2       exists:X-PHP-Script
score    FSL_ABUSED_WEB_2       0.01
describe FSL_ABUSED_WEB_2       Has X-PHP-Script header

header   FSL_ABUSED_WEB_3       exists:X-PHP-Originating-Script
score    FSL_ABUSED_WEB_3       0.01
describe FSL_ABUSED_WEB_3       Has X-PHP-Originating-Script header

meta     FSL_UNDISCLOSED_BULK  (FSL_UNDISCLOSED_RCPTS && (DCC_CHECK || RAZOR2_CHECK || PYZOR_CHECK))
describe FSL_UNDISCLOSED_BULK  Undisclosed recipients and bulk signature
score    FSL_UNDISCLOSED_BULK  3.0

# Received: from hwyhsxwaxz (amandacallow@113.162.65.176 with login) by
header   __FSL_YAHOO_AUTH1      Received =~ /from [a-z]{10} \([^\@ ]+\@\d+\.\d+\.\d+\.\d+ with (?:plain|login)\) /
# Received: from localhost (rhinotrick@46.185.178.15 with login) by
header   __FSL_YAHOO_AUTH2      Received =~ /from localhost \([^\@ ]+\@\d+\.\d+\.\d+\.\d+ with (?:plain|login)\) /i
header   __FSL_YAHOO_AUTH3      Received =~ /from user \([^\@ ]+\@\d+\.\d+\.\d+\.\d+ with (?:plain|login)\) /i
meta     FSL_YAHOO_AUTH_SIG     (__FSL_RELAY_YAHOO && (__FSL_YAHOO_AUTH1 || __FSL_YAHOO_AUTH2 || __FSL_YAHOO_AUTH3))
describe FSL_YAHOO_AUTH_SIG     Yahoo SMTP AUTH observed patterns
score    FSL_YAHOO_AUTH_SIG     5.0

ifplugin Mail::SpamAssassin::Plugin::FreeMail
# Test potential error in base rules
header   __smf_freemail_hdr_replyto  eval:check_freemail_header('Reply-To:addr')
meta     SMF_FM_FORGED_REPLYTO  __smf_freemail_hdr_replyto && !FREEMAIL_FROM && !__freemail_safe
describe SMF_FM_FORGED_REPLYTO  Freemail in Reply-To, but not From
tflags	 SMF_FM_FORGED_REPLYTO  nopublish
#score    SMF_FM_FORGED_REPLYTO  0.1
endif