if (version >= 3.004002)
ifplugin Mail::SpamAssassin::Plugin::WLBLEval

enlist_addrlist (PAYPAL) *@paypal.com *@paypal.co.uk *@paypal.de *@paypal.com.au *@paypal.it
enlist_addrlist (PAYPAL) *@paypal.es *@paypal.fr *@paypal.de *@paypal.com.hk
enlist_addrlist (PAYPAL) *@*.paypal.com *@*.paypal.co.uk

header   __FROM_ADDRLIST_PAYPAL eval:check_from_in_list('PAYPAL')
reuse    __FROM_ADDRLIST_PAYPAL

meta     FROM_PAYPAL_SPOOF  !__NOT_SPOOFED && __FROM_ADDRLIST_PAYPAL && (! NO_RELAYS && ! ALL_TRUSTED)
tflags   FROM_PAYPAL_SPOOF  publish net
describe FROM_PAYPAL_SPOOF  From PayPal domain but matches SPOOFED
score    FROM_PAYPAL_SPOOF  1.6 # limit
reuse    FROM_PAYPAL_SPOOF

#meta     FROM_PAYPAL_REPLYTO_FREEMAIL FREEMAIL_FORGED_REPLYTO && __FROM_ADDRLIST_PAYPAL && !DKIM_VALID_AU
#tflags   FROM_PAYPAL_REPLYTO_FREEMAIL publish net
#describe FROM_PAYPAL_REPLYTO_FREEMAIL From PayPal domain but ReplyTo is FREEMAIL
#score    FROM_PAYPAL_REPLYTO_FREEMAIL 2.0
#reuse    FROM_PAYPAL_REPLYTO_FREEMAIL

enlist_addrlist (BANKS) *@abbey.co.uk *@abbey.com *@abbeyinternational.com *@abbeyinternational.co.uk *@abbeynational.com *@abbeynational.co.uk
enlist_addrlist (BANKS) *@allianceleicester.com *@allianceleicester.co.uk *@alliance-leicester.com *@alliance-leicester.co.uk
enlist_addrlist (BANKS) *@bankofamerica.com *@bankofamerica.co.uk
enlist_addrlist (BANKS) *@barclaycard.com *@barclays.com
enlist_addrlist (BANKS) *@citibank.com
enlist_addrlist (BANKS) *@firstdirect.com *@firstdirect.co.uk
enlist_addrlist (BANKS) *@halifax.com *@halifax.co.uk *@halifax-online.co.uk *@halifax-online.com
enlist_addrlist (BANKS) *@hbos.com *@hbos.co.uk
enlist_addrlist (BANKS) *@hsbc.com *@hsbc.co.uk *@hsbc.hk *@hsbcgroup.com *@hsbcgroup.co.uk
enlist_addrlist (BANKS) *@lloydstsb.com *@lloydstsb.co.uk *@lloyds.com
enlist_addrlist (BANKS) *@mbna.com
enlist_addrlist (BANKS) *@nationwide.com *@nationwide.co.uk
enlist_addrlist (BANKS) *@natwest.com *@natwest.co.uk
enlist_addrlist (BANKS) *@santander.com *@santander.co.uk
enlist_addrlist (BANKS) *@standardbank.co.za
enlist_addrlist (BANKS) *@ybonline.co.uk *@ybonline.com

header   __FROM_ADDRLIST_BANKS eval:check_from_in_list('BANKS')
reuse    __FROM_ADDRLIST_BANKS

meta     FROM_BANK_NOAUTH  __FROM_ADDRLIST_BANKS && (! NO_RELAYS && ! ALL_TRUSTED) && (! SPF_PASS && ! DKIM_VALID_AU)
tflags   FROM_BANK_NOAUTH  publish net
describe FROM_BANK_NOAUTH  From Bank domain but no SPF or DKIM
score    FROM_BANK_NOAUTH  1.0 # limit
reuse    FROM_BANK_NOAUTH

endif
endif