Cloudron makes it easy to run web apps like WordPress, Nextcloud, GitLab on your server. Find out more or install now.


    Cloudron Forum

    • Register
    • Login
    • Search
    • Categories
    • Recent
    • Tags
    • Popular

    Sharing custom SpamAssassin Rules

    Discuss
    mail spam
    11
    31
    1669
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • d19dotca
      d19dotca last edited by d19dotca

      I made a small update as I continue forwards on this project. Here's an updated list. Feel free to use something like diffchecker.com to determine what specifically was changed between them so far.

      The highlights include (but not limited to):

      • Correcting the scores for SPF & DKIM passes to not be as high as I had them (in fact I basically nullified them now) as it's easy for spammers to fool those, while having a harsher score for any SPF & DKIM failures still, as generally recommended by SpamAssassin
      • Updated the BAYES learning scores - mostly corrected the BAYES_999 one as that is meant to be on top of BAYES_99, in other words they are always scored together if it's that confident, it won't be BAYES_999 ever on its own so I didn't need to have that score be so high, among a couple other scoring tweaks to them
      • Added a few SpamEatingMonkey DNSBLs / URIBLs to the list for extra scoring - this has seemingly helped a lot by having extra checks done which all compound usually with the other DNSBLs that get triggered too
      • I tweaked the scores a bit for some of the DNSBLs & URIBLs, making some a little more aggressive and some a little bit less aggressive depending on any false-positive rates and the description of each check, etc
      • Updated and added in more HTML & HEADER & MISSING related scores

      Your mileage may vary, but I believe this new list is an improvement over the previous one.

      # scoring DNSBLs (blocklists & allowlists)
      score RCVD_IN_BL_SPAMCOP_NET 3.0
      score RCVD_IN_DNSWL_HI -5.0
      score RCVD_IN_DNSWL_LOW -0.5
      score RCVD_IN_DNSWL_MED -2.5
      score RCVD_IN_DNSWL_NONE 0.5
      score RCVD_IN_GBUDB 4.0
      score RCVD_IN_IADB_DK -0.5
      score RCVD_IN_IADB_DOPTIN_GT50 -0.5
      score RCVD_IN_IADB_DOPTIN_LT50 -0.5
      score RCVD_IN_IADB_EDDB -0.5
      score RCVD_IN_IADB_EPIA -0.5
      score RCVD_IN_IADB_GOODMAIL -0.5
      score RCVD_IN_IADB_LISTED -0.5
      score RCVD_IN_IADB_LOOSE -0.5
      score RCVD_IN_IADB_MI_CPEAR 0
      score RCVD_IN_IADB_MI_CPR_30 0
      score RCVD_IN_IADB_MI_CPR_MAT 0.0
      score RCVD_IN_IADB_NOCONTROL -0.5
      score RCVD_IN_IADB_OOO -0.5
      score RCVD_IN_IADB_OPTIN -0.5
      score RCVD_IN_IADB_OPTIN_GT50 -0.5
      score RCVD_IN_IADB_OPTIN_LT50 -0.5
      score RCVD_IN_IADB_OPTOUTONLY -0.5
      score RCVD_IN_IADB_RDNS -0.5
      score RCVD_IN_IADB_SENDERID -0.5
      score RCVD_IN_IADB_SPF -0.5
      score RCVD_IN_IADB_UNVERIFIED_1 -0.5
      score RCVD_IN_IADB_UNVERIFIED_2 -0.5
      score RCVD_IN_IADB_UT_CPEAR 0
      score RCVD_IN_IADB_UT_CPR_30 0
      score RCVD_IN_IADB_UT_CPR_MAT 0
      score RCVD_IN_JMF_BL 3.5
      score RCVD_IN_MSPIKE_BL 0.0
      score RCVD_IN_MSPIKE_H2 0.0
      score RCVD_IN_MSPIKE_H3 -0.5
      score RCVD_IN_MSPIKE_H4 -2.0
      score RCVD_IN_MSPIKE_H5 -3.0
      score RCVD_IN_MSPIKE_L2 1.5
      score RCVD_IN_MSPIKE_L3 3.5
      score RCVD_IN_MSPIKE_L4 4.5
      score RCVD_IN_MSPIKE_L5 5.0
      score RCVD_IN_MSPIKE_WL 0.0
      score RCVD_IN_MSPIKE_ZBI 4.0
      score RCVD_IN_PBL 3.5
      score RCVD_IN_SBL 3.5
      score RCVD_IN_SBL_CSS 3.5
      score RCVD_IN_SEM_BLACK 3.5
      score RCVD_IN_SEM_NET_BLACK 2.5
      score RCVD_IN_SORBS_BLOCK 2.5
      score RCVD_IN_SORBS_DUL 2.5
      score RCVD_IN_SORBS_HTTP 2.5
      score RCVD_IN_SORBS_MISC 2.5
      score RCVD_IN_SORBS_SMTP 2.5
      score RCVD_IN_SORBS_SOCKS 2.5
      score RCVD_IN_SORBS_SPAM 2.5
      score RCVD_IN_SORBS_WEB 2.5
      score RCVD_IN_SORBS_ZOMBIE 2.5
      score RCVD_IN_SPAMRATS 3.5
      score RCVD_IN_XBL 3.5
      score RCVD_IN_ZEN_BLOCKED 0.0
      score RCVD_IN_ZEN_BLOCKED_OPENDNS 0.0
      
      # scoring URIBLs
      score URIBL_ABUSE_SURBL 4.0
      score URIBL_BLACK 4.0
      score URIBL_CR_SURBL 4.0
      score URIBL_CSS 2.0
      score URIBL_CSS_A 2.0
      score URIBL_DBL_ABUSE_BOTCC 3.5
      score URIBL_DBL_ABUSE_MALW  3.5
      score URIBL_DBL_ABUSE_PHISH 3.5
      score URIBL_DBL_ABUSE_REDIR 3.5
      score URIBL_DBL_ABUSE_SPAM 3.5
      score URIBL_DBL_BLOCKED 0.0
      score URIBL_DBL_BLOCKED_OPENDNS 0.0
      score URIBL_DBL_BOTNETCC 3.5
      score URIBL_DBL_ERROR 3.5
      score URIBL_DBL_MALWARE 3.5
      score URIBL_DBL_PHISH 3.5
      score URIBL_DBL_SPAM 3.5
      score URIBL_GREY 2.0
      score URIBL_MW_SURBL 4.0
      score URIBL_PH_SURBL 4.0
      score URIBL_RED 2.5
      score URIBL_RHS_DOB 2.0
      score URIBL_SBL 2.0
      score URIBL_SBL_A 2.0
      score URIBL_SEM 2.5
      score URIBL_SEM_FRESH30 2.0
      score URIBL_WS_SURBL 3.0
      score URIBL_ZEN_BLOCKED 0.0
      score URIBL_ZEN_BLOCKED_OPENDNS 0.0
      
      # scoring DKIM & SPF
      score DKIM_INVALID 1.5
      score DKIM_SIGNED 0.0
      score DKIM_VALID 0.0
      score DKIM_VALID_AU 0.0
      score DKIM_VALID_EF 0.0
      score DKIM_VERIFIED 0.0
      score FORGED_SPF_HELO 3.0
      score SPF_FAIL 1.5
      score SPF_HELO_FAIL 1.5
      score SPF_HELO_NEUTRAL 1.0
      score SPF_HELO_NONE 0.5
      score SPF_HELO_PASS 0.0
      score SPF_HELO_SOFTFAIL 1.5
      score SPF_NEUTRAL 0.5
      score SPF_NONE 0.5
      score SPF_PASS 0.0
      score SPF_SOFTFAIL 1.5
      
      # scoring BAYES
      score BAYES_00 -2.5
      score BAYES_05  -1.0
      score BAYES_20  0.5
      score BAYES_40  1.5
      score BAYES_50  2.0
      score BAYES_60  3.0
      score BAYES_80  4.0
      score BAYES_95  4.5
      score BAYES_99  5.0
      score BAYES_999 1.5
      
      # scoring HTML
      score HTML_FONT_LOW_CONTRAST 1.0
      score HTML_IMAGE_ONLY_04 1.5
      score HTML_IMAGE_ONLY_08 2.0
      score HTML_IMAGE_ONLY_12 2.0
      score HTML_IMAGE_ONLY_16 2.0
      score HTML_IMAGE_ONLY_20 2.0
      score HTML_IMAGE_ONLY_24 2.5
      score HTML_IMAGE_ONLY_28 2.5
      score HTML_IMAGE_ONLY_32 3.0
      score HTML_IMAGE_RATIO_02 0.0
      score HTML_IMAGE_RATIO_04 0.0
      score HTML_IMAGE_RATIO_06 0.0
      score HTML_IMAGE_RATIO_08 0.0
      score HTML_MESSAGE 0.0
      
      # scoring HEADER & MISSING
      score HEADER_FROM_DIFFERENT_DOMAINS 1.0
      score HEADER_SPAM 2.5
      score MISSING_DATE 3.0
      score MISSING_FROM 1.5
      score MISSING_HB_SEP 0.0
      score MISSING_HEADERS 1.5
      score MISSING_MID 1.0
      score MISSING_MIMEOLE 2.0
      score MISSING_SUBJECT 2.0
      
      # scoring FREEMAIL
      score FORGED_GMAIL_RCVD 2.5
      score FORGED_YAHOO_RCVD 2.5
      score FREEMAIL_ENVFROM_END_DIGIT 0.5
      score FREEMAIL_FORGED_REPLYTO 2.5
      score FREEMAIL_FROM 0
      score FREEMAIL_REPLY 1.0
      score FREEMAIL_REPLYTO 1.0
      score FREEMAIL_REPLYTO_END_DIGIT 0.5
      score MALFORMED_FREEMAIL 4.0
      
      # additional scoring tweaks
      score BILLION_DOLLARS 2.0
      score EMPTY_MESSAGE 1.5
      score HK_RANDOM_ENVFROM 1.0
      score HK_RANDOM_FROM 1.0
      score LOTS_OF_MONEY 1.0
      score MPART_ALT_DIFF 2.5
      score MPART_ALT_DIFF_COUNT 2.5
      score NO_DNS_FOR_FROM 0.5
      score RDNS_NONE 1.0
      score REPLYTO_WITHOUT_TO_CC 2.5
      score UNPARSEABLE_RELAY 0.5
      score URI_DQ_UNSUB 2.0
      
      # add GDUB TRUNCATE DNSBL
      header RCVD_IN_GBUDB eval:check_rbl('gbudb', 'truncate.gbudb.net.')
      describe RCVD_IN_GBUDB Listed in truncate.gbudb.net
      tflags RCVD_IN_GBUDB net
      
      # add JMF-Black DNSBL
      header RCVD_IN_JMF_BL eval:check_rbl('jmfbl', 'black.junkemailfilter.com.')
      describe RCVD_IN_JMF_BL Listed in black.junkemailfilter.com
      tflags RCVD_IN_JMF_BL net
      
      # add Spamrats DNSBL
      header RCVD_IN_SPAMRATS eval:check_rbl('spamrats', 'all.spamrats.com.')
      describe RCVD_IN_SPAMRATS Sender listed in all.spamrats.com
      tflags RCVD_IN_SPAMRATS net
      
      # add SpamEatingMonkey DNSBL
      header RCVD_IN_SEM_NET_BLACK eval:check_rbl('sem', 'netbl.spameatingmonkey.net')
      tflags RCVD_IN_SEM_NET_BLACK net
      describe RCVD_IN_SEM_NET_BLACK Received from an IP listed by SpamEatingMonkeys
      
      # add second SpamEatingMonkey DNSBL
      header RCVD_IN_SEM_BLACK eval:check_rbl('sem', 'bl.spameatingmonkey.net')
      tflags RCVD_IN_SEM_BLACK net
      describe RCVD_IN_SEM_BLACK Received from an IP listed by SpamEatingMonkeys
      
      # add SpamEatingMonkey URIBL
      urirhssub URIBL_SEM uribl.spameatingmonkey.net. A 2
      body URIBL_SEM eval:check_uridnsbl('URIBL_SEM')
      describe URIBL_SEM Contains a URI listed by SpamEatingMonkeys
      tflags URIBL_SEM net
      
      # add second SpamEatingMonkey URIBL
      urirhssub URIBL_SEM_FRESH30 fresh30.spameatingmonkey.net. A 2
      body URIBL_SEM_FRESH30 eval:check_uridnsbl('URIBL_SEM_FRESH30')
      describe URIBL_SEM_FRESH30 Contains a domain registered less than 30 days ago
      tflags URIBL_SEM_FRESH30 net
      

      --
      Dustin Dauncey
      www.d19.ca

      1 Reply Last reply Reply Quote 4
      • robi
        robi last edited by

        This is great work!

        Can you add a reminder in the top post of how to install them?

        Life of Advanced Technology

        d19dotca 1 Reply Last reply Reply Quote 2
        • d19dotca
          d19dotca @robi last edited by d19dotca

          @robi said in Sharing custom SpamAssassin Rules:

          Can you add a reminder in the top post of how to install them?

          Great idea! Just updated it. It now links to the SpamAssassin default scores, and to the Cloudron docs on how to create new custom spam filtering rules ๐Ÿ™‚

          --
          Dustin Dauncey
          www.d19.ca

          1 Reply Last reply Reply Quote 2
          • d19dotca
            d19dotca last edited by

            Latest round of SpamAssassin rules I'm using, if anyone is interested.

            The highlights here are just a couple of things:

            • A few new sources which come with new rules
            • Slight scoring tweaks on just a few rules

            Of course, as they say... YMMV. ๐Ÿ˜‰

            # scoring DNSBLs (blocklists & allowlists)
            score RCVD_IN_BL_SPAMCOP_NET 2.5
            score RCVD_IN_DNSWL_HI -5.0
            score RCVD_IN_DNSWL_LOW -0.5
            score RCVD_IN_DNSWL_MED -2.5
            score RCVD_IN_DNSWL_NONE 0.5
            score RCVD_IN_GBUDB 4.5
            score RCVD_IN_IADB_DK -0.5
            score RCVD_IN_IADB_DOPTIN_GT50 -0.5
            score RCVD_IN_IADB_DOPTIN_LT50 -0.5
            score RCVD_IN_IADB_EDDB -0.5
            score RCVD_IN_IADB_EPIA -0.5
            score RCVD_IN_IADB_GOODMAIL -0.5
            score RCVD_IN_IADB_LISTED -0.5
            score RCVD_IN_IADB_LOOSE -0.5
            score RCVD_IN_IADB_MI_CPEAR 0
            score RCVD_IN_IADB_MI_CPR_30 0
            score RCVD_IN_IADB_MI_CPR_MAT 0.0
            score RCVD_IN_IADB_NOCONTROL -0.5
            score RCVD_IN_IADB_OOO -0.5
            score RCVD_IN_IADB_OPTIN -0.5
            score RCVD_IN_IADB_OPTIN_GT50 -0.5
            score RCVD_IN_IADB_OPTIN_LT50 -0.5
            score RCVD_IN_IADB_OPTOUTONLY -0.5
            score RCVD_IN_IADB_RDNS -0.5
            score RCVD_IN_IADB_SENDERID -0.5
            score RCVD_IN_IADB_SPF -0.5
            score RCVD_IN_IADB_UNVERIFIED_1 -0.5
            score RCVD_IN_IADB_UNVERIFIED_2 -0.5
            score RCVD_IN_IADB_UT_CPEAR 0
            score RCVD_IN_IADB_UT_CPR_30 0
            score RCVD_IN_IADB_UT_CPR_MAT 0
            score RCVD_IN_JMF_BL 2.5
            score RCVD_IN_MSPIKE_BL 0.0
            score RCVD_IN_MSPIKE_H2 0.0
            score RCVD_IN_MSPIKE_H3 -0.5
            score RCVD_IN_MSPIKE_H4 -2.0
            score RCVD_IN_MSPIKE_H5 -3.0
            score RCVD_IN_MSPIKE_L2 1.5
            score RCVD_IN_MSPIKE_L3 3.5
            score RCVD_IN_MSPIKE_L4 4.5
            score RCVD_IN_MSPIKE_L5 5.0
            score RCVD_IN_MSPIKE_WL 0.0
            score RCVD_IN_MSPIKE_ZBI 4.0
            score RCVD_IN_PBL 3.5
            score RCVD_IN_SBL 3.5
            score RCVD_IN_SBL_CSS 3.5
            score RCVD_IN_SEM_BACKSCATTER 1.5
            score RCVD_IN_SEM_BLACK 3.5
            score RCVD_IN_SEM_NET_BLACK 2.5
            score RCVD_IN_SORBS_BLOCK 2.5
            score RCVD_IN_SORBS_DUL 2.5
            score RCVD_IN_SORBS_HTTP 2.5
            score RCVD_IN_SORBS_MISC 2.5
            score RCVD_IN_SORBS_SMTP 2.5
            score RCVD_IN_SORBS_SOCKS 2.5
            score RCVD_IN_SORBS_SPAM 2.5
            score RCVD_IN_SORBS_WEB 2.5
            score RCVD_IN_SORBS_ZOMBIE 2.5
            score RCVD_IN_SPAMRATS 2.5
            score RCVD_IN_XBL 3.5
            score RCVD_IN_ZEN_BLOCKED 0.0
            score RCVD_IN_ZEN_BLOCKED_OPENDNS 0.0
            
            # scoring URIBLs
            score URIBL_ABUSE_SURBL 4.0
            score URIBL_BLACK 4.5
            score URIBL_CR_SURBL 4.0
            score URIBL_CSS 2.0
            score URIBL_CSS_A 2.0
            score URIBL_DBL_ABUSE_BOTCC 3.5
            score URIBL_DBL_ABUSE_MALW  3.5
            score URIBL_DBL_ABUSE_PHISH 3.5
            score URIBL_DBL_ABUSE_REDIR 3.5
            score URIBL_DBL_ABUSE_SPAM 3.5
            score URIBL_DBL_BLOCKED 0.0
            score URIBL_DBL_BLOCKED_OPENDNS 0.0
            score URIBL_DBL_BOTNETCC 3.5
            score URIBL_DBL_ERROR 3.5
            score URIBL_DBL_MALWARE 3.5
            score URIBL_DBL_PHISH 3.5
            score URIBL_DBL_SPAM 3.5
            score URIBL_GREY 1.0
            score URIBL_MW_SURBL 4.0
            score URIBL_PH_SURBL 4.0
            score URIBL_RED 1.5
            score URIBL_RHS_DOB 2.0
            score URIBL_SBL 2.0
            score URIBL_SBL_A 2.0
            score URIBL_SEM 3.0
            score URIBL_SEM_FRESH30 1.5
            score URIBL_WS_SURBL 3.0
            score URIBL_ZEN_BLOCKED 0.0
            score URIBL_ZEN_BLOCKED_OPENDNS 0.0
            
            # scoring DKIM & SPF
            score DKIM_INVALID 1.5
            score DKIM_SIGNED 0.0
            score DKIM_VALID 0.0
            score DKIM_VALID_AU 0.0
            score DKIM_VALID_EF 0.0
            score DKIM_VERIFIED 0.0
            score DKIMWL_BL 3.0
            score DKIMWL_WL_HIGH -3.5
            score DKIMWL_WL_MED -1.5
            score DKIMWL_WL_MEDHI -2.5
            score FORGED_SPF_HELO 3.0
            score SPF_FAIL 1.5
            score SPF_HELO_FAIL 1.5
            score SPF_HELO_NEUTRAL 1.0
            score SPF_HELO_NONE 0.5
            score SPF_HELO_PASS 0.0
            score SPF_HELO_SOFTFAIL 1.5
            score SPF_NEUTRAL 0.5
            score SPF_NONE 0.5
            score SPF_PASS 0.0
            score SPF_SOFTFAIL 1.5
            
            # scoring BAYES
            score BAYES_00 -3.0
            score BAYES_05  -1.5
            score BAYES_20  0.5
            score BAYES_40  1.5
            score BAYES_50  2.0
            score BAYES_60  3.0
            score BAYES_80  4.0
            score BAYES_95  4.5
            score BAYES_99  5.0
            score BAYES_999 1.5
            
            # scoring HTML
            score HTML_FONT_LOW_CONTRAST 0.5
            score HTML_IMAGE_ONLY_04 1.5
            score HTML_IMAGE_ONLY_08 2.0
            score HTML_IMAGE_ONLY_12 2.0
            score HTML_IMAGE_ONLY_16 2.0
            score HTML_IMAGE_ONLY_20 2.0
            score HTML_IMAGE_ONLY_24 2.5
            score HTML_IMAGE_ONLY_28 2.5
            score HTML_IMAGE_ONLY_32 3.0
            score HTML_IMAGE_RATIO_02 0.0
            score HTML_IMAGE_RATIO_04 0.0
            score HTML_IMAGE_RATIO_06 0.0
            score HTML_IMAGE_RATIO_08 0.0
            score HTML_MESSAGE 0.0
            
            # scoring HEADER & MISSING
            score HEADER_FROM_DIFFERENT_DOMAINS 0.5
            score HEADER_SPAM 2.5
            score MISSING_DATE 3.0
            score MISSING_FROM 1.5
            score MISSING_HB_SEP 0.0
            score MISSING_HEADERS 1.5
            score MISSING_MID 1.0
            score MISSING_MIMEOLE 2.0
            score MISSING_SUBJECT 2.0
            
            # scoring FREEMAIL
            score FORGED_GMAIL_RCVD 2.5
            score FORGED_YAHOO_RCVD 2.5
            score FREEMAIL_ENVFROM_END_DIGIT 0.5
            score FREEMAIL_FORGED_REPLYTO 1.5
            score FREEMAIL_FROM 0
            score FREEMAIL_REPLY 1.0
            score FREEMAIL_REPLYTO 1.0
            score FREEMAIL_REPLYTO_END_DIGIT 0.5
            score MALFORMED_FREEMAIL 4.0
            
            # additional scoring tweaks
            score BILLION_DOLLARS 2.0
            score BODY_URI_ONLY 1.5
            score EMPTY_MESSAGE 1.5
            score HELO_DYNAMIC_SPLIT_IP 2.0
            score HK_RANDOM_ENVFROM 0.5
            score HK_RANDOM_FROM 0.5
            score LOTS_OF_MONEY 0.5
            score MPART_ALT_DIFF 1.0
            score MPART_ALT_DIFF_COUNT 1.5
            score NO_DNS_FOR_FROM 0.5
            score PDS_TONAME_EQ_TOLOCAL 0.5
            score PDS_TONAME_EQ_TOLOCAL_VSHORT 0.5
            score RDNS_NONE 1.5
            score REPLYTO_WITHOUT_TO_CC 2.5
            score UNPARSEABLE_RELAY 0.5
            score URI_DQ_UNSUB 2.0
            
            # add GDUB TRUNCATE DNSBL
            header RCVD_IN_GBUDB eval:check_rbl('gbudb', 'truncate.gbudb.net.')
            describe RCVD_IN_GBUDB Listed in truncate.gbudb.net
            tflags RCVD_IN_GBUDB net
            
            # add JMF-Black DNSBL
            header RCVD_IN_JMF_BL eval:check_rbl('jmf', 'black.junkemailfilter.com.')
            describe RCVD_IN_JMF_BL Listed in black.junkemailfilter.com
            tflags RCVD_IN_JMF_BL net
            
            # add Spamrats DNSBL
            header RCVD_IN_SPAMRATS eval:check_rbl('spamrats', 'all.spamrats.com.')
            describe RCVD_IN_SPAMRATS Sender listed in all.spamrats.com
            tflags RCVD_IN_SPAMRATS net
            
            # add SpamEatingMonkey backscatter DNSBL
            header RCVD_IN_SEM_BACKSCATTER eval:check_rbl('sem', 'backscatter.spameatingmonkey.net')
            tflags RCVD_IN_SEM_BACKSCATTER net
            describe RCVD_IN_SEM_BACKSCATTER Received from an IP listed by SEM-BACKSCATTER
            
            # add SpamEatingMonkey network blacklist DNSBL
            header RCVD_IN_SEM_NET_BLACK eval:check_rbl('sem', 'netbl.spameatingmonkey.net')
            tflags RCVD_IN_SEM_NET_BLACK net
            describe RCVD_IN_SEM_NET_BLACK Received from an IP listed by SpamEatingMonkeys
            
            # add SpamEatingMonkey blacklist DNSBL
            header RCVD_IN_SEM_BLACK eval:check_rbl('sem', 'bl.spameatingmonkey.net')
            tflags RCVD_IN_SEM_BLACK net
            describe RCVD_IN_SEM_BLACK Received from an IP listed by SpamEatingMonkeys
            
            # add SpamEatingMonkey URIBL
            urirhssub URIBL_SEM uribl.spameatingmonkey.net. A 2
            body URIBL_SEM eval:check_uridnsbl('URIBL_SEM')
            describe URIBL_SEM Contains a URI listed by SpamEatingMonkeys
            tflags URIBL_SEM net
            
            # add SpamEatingMonkey fresh domain URIBL
            urirhssub URIBL_SEM_FRESH30 fresh30.spameatingmonkey.net. A 2
            body URIBL_SEM_FRESH30 eval:check_uridnsbl('URIBL_SEM_FRESH30')
            describe URIBL_SEM_FRESH30 From a domain registered less than 30 days ago
            tflags URIBL_SEM_FRESH30 net
            

            --
            Dustin Dauncey
            www.d19.ca

            necrevistonnezr micmc 2 Replies Last reply Reply Quote 10
            • necrevistonnezr
              necrevistonnezr @d19dotca last edited by

              @d19dotca I understand correctly - I can copy & paste your list in the "Custom Spam Filtering Rules" section to try it out, correct?

              humptydumpty d19dotca 2 Replies Last reply Reply Quote 1
              • micmc
                micmc @d19dotca last edited by

                @d19dotca said in Sharing custom SpamAssassin Rules:

                Latest round of SpamAssassin rules I'm using, if anyone is interested.

                The highlights here are just a couple of things:

                • A few new sources which come with new rules
                • Slight scoring tweaks on just a few rules

                Of course, as they say... YMMV. ๐Ÿ˜‰

                Amazing stuff mate! That's a great work and thank you so much for sharing this with the folks here. ๐Ÿ™‚


                https://marketingtechnology.agency
                For cutting edge web technologies

                1 Reply Last reply Reply Quote 3
                • humptydumpty
                  humptydumpty @necrevistonnezr last edited by

                  @necrevistonnezr That's right.

                  1 Reply Last reply Reply Quote 2
                  • d19dotca
                    d19dotca @necrevistonnezr last edited by d19dotca

                    @necrevistonnezr Yes, you can simply copy & paste the entire thing. ๐Ÿ™‚

                    Btw, here is my current rules (hasn't changed too much though from the previous one I shared):

                    # scoring DNSBLs (blocklists & allowlists)
                    score RCVD_IN_BL_SPAMCOP_NET 2.5
                    score RCVD_IN_DNSWL_BLOCKED 0.0
                    score RCVD_IN_DNSWL_HI -5.0
                    score RCVD_IN_DNSWL_LOW -1.0
                    score RCVD_IN_DNSWL_MED -2.5
                    score RCVD_IN_DNSWL_NONE 0.5
                    score RCVD_IN_GBUDB 4.5
                    score RCVD_IN_IADB_DK -0.5
                    score RCVD_IN_IADB_DOPTIN_GT50 -0.5
                    score RCVD_IN_IADB_DOPTIN_LT50 -0.5
                    score RCVD_IN_IADB_EDDB -0.5
                    score RCVD_IN_IADB_EPIA -0.5
                    score RCVD_IN_IADB_GOODMAIL -0.5
                    score RCVD_IN_IADB_LISTED -0.5
                    score RCVD_IN_IADB_LOOSE -0.5
                    score RCVD_IN_IADB_MI_CPEAR 0
                    score RCVD_IN_IADB_MI_CPR_30 0
                    score RCVD_IN_IADB_MI_CPR_MAT 0.0
                    score RCVD_IN_IADB_NOCONTROL -0.5
                    score RCVD_IN_IADB_OOO -0.5
                    score RCVD_IN_IADB_OPTIN -0.5
                    score RCVD_IN_IADB_OPTIN_GT50 -0.5
                    score RCVD_IN_IADB_OPTIN_LT50 -0.5
                    score RCVD_IN_IADB_OPTOUTONLY -0.5
                    score RCVD_IN_IADB_RDNS -0.5
                    score RCVD_IN_IADB_SENDERID -0.5
                    score RCVD_IN_IADB_SPF -0.5
                    score RCVD_IN_IADB_UNVERIFIED_1 -0.5
                    score RCVD_IN_IADB_UNVERIFIED_2 -0.5
                    score RCVD_IN_IADB_UT_CPEAR 0
                    score RCVD_IN_IADB_UT_CPR_30 0
                    score RCVD_IN_IADB_UT_CPR_MAT 0
                    score RCVD_IN_JMF_BL 2.5
                    score RCVD_IN_MSPIKE_BL 0.0
                    score RCVD_IN_MSPIKE_H2 0.0
                    score RCVD_IN_MSPIKE_H3 -0.5
                    score RCVD_IN_MSPIKE_H4 -2.0
                    score RCVD_IN_MSPIKE_H5 -3.0
                    score RCVD_IN_MSPIKE_L2 1.5
                    score RCVD_IN_MSPIKE_L3 2.5
                    score RCVD_IN_MSPIKE_L4 4.0
                    score RCVD_IN_MSPIKE_L5 5.0
                    score RCVD_IN_MSPIKE_WL 0.0
                    score RCVD_IN_MSPIKE_ZBI 4.0
                    score RCVD_IN_PBL 3.5
                    score RCVD_IN_SBL 3.5
                    score RCVD_IN_SBL_CSS 3.5
                    score RCVD_IN_SEM_BACKSCATTER 1.5
                    score RCVD_IN_SEM_BLACK 3.5
                    score RCVD_IN_SEM_NET_BLACK 2.5
                    score RCVD_IN_SORBS_BLOCK 2.5
                    score RCVD_IN_SORBS_DUL 2.5
                    score RCVD_IN_SORBS_HTTP 2.5
                    score RCVD_IN_SORBS_MISC 2.5
                    score RCVD_IN_SORBS_SMTP 2.5
                    score RCVD_IN_SORBS_SOCKS 2.5
                    score RCVD_IN_SORBS_SPAM 2.5
                    score RCVD_IN_SORBS_WEB 2.5
                    score RCVD_IN_SORBS_ZOMBIE 2.5
                    score RCVD_IN_SPAMRATS 2.0
                    score RCVD_IN_UCEPROTECT2 1.5
                    score RCVD_IN_XBL 3.5
                    score RCVD_IN_ZEN_BLOCKED 0.0
                    score RCVD_IN_ZEN_BLOCKED_OPENDNS 0.0
                    
                    # scoring URIBLs
                    score URIBL_ABUSE_SURBL 4.0
                    score URIBL_BLACK 4.5
                    score URIBL_CR_SURBL 4.0
                    score URIBL_CSS 2.0
                    score URIBL_CSS_A 2.0
                    score URIBL_DBL_ABUSE_BOTCC 3.0
                    score URIBL_DBL_ABUSE_MALW  3.0
                    score URIBL_DBL_ABUSE_PHISH 3.0
                    score URIBL_DBL_ABUSE_REDIR 1.0
                    score URIBL_DBL_ABUSE_SPAM 3.0
                    score URIBL_DBL_BLOCKED 0.0
                    score URIBL_DBL_BLOCKED_OPENDNS 0.0
                    score URIBL_DBL_BOTNETCC 3.5
                    score URIBL_DBL_ERROR 0.0
                    score URIBL_DBL_MALWARE 3.5
                    score URIBL_DBL_PHISH 3.5
                    score URIBL_DBL_SPAM 3.5
                    score URIBL_GREY 1.0
                    score URIBL_MW_SURBL 4.0
                    score URIBL_PH_SURBL 4.0
                    score URIBL_RED 1.5
                    score URIBL_RHS_DOB 2.0
                    score URIBL_SBL 1.5
                    score URIBL_SBL_A 1.5
                    score URIBL_SEM 3.0
                    score URIBL_SEM_FRESH30 1.5
                    score URIBL_WS_SURBL 3.0
                    score URIBL_ZEN_BLOCKED 0.0
                    score URIBL_ZEN_BLOCKED_OPENDNS 0.0
                    
                    # scoring DKIM & SPF
                    score DKIM_INVALID 1.5
                    score DKIM_SIGNED 0.0
                    score DKIM_VALID 0.0
                    score DKIM_VALID_AU 0.0
                    score DKIM_VALID_EF 0.0
                    score DKIM_VERIFIED 0.0
                    score DKIMWL_BL 3.0
                    score DKIMWL_WL_HIGH -3.5
                    score DKIMWL_WL_MED -1.5
                    score DKIMWL_WL_MEDHI -2.5
                    score FORGED_SPF_HELO 3.0
                    score SPF_FAIL 1.5
                    score SPF_HELO_FAIL 1.5
                    score SPF_HELO_NEUTRAL 1.0
                    score SPF_HELO_NONE 0.5
                    score SPF_HELO_PASS 0.0
                    score SPF_HELO_SOFTFAIL 1.5
                    score SPF_NEUTRAL 0.5
                    score SPF_NONE 0.5
                    score SPF_PASS 0.0
                    score SPF_SOFTFAIL 1.5
                    
                    # scoring BAYES
                    score BAYES_00 -4.0
                    score BAYES_05  -3.0
                    score BAYES_20  0.5
                    score BAYES_40  1.5
                    score BAYES_50  2.0
                    score BAYES_60  3.0
                    score BAYES_80  3.5
                    score BAYES_95  4.5
                    score BAYES_99  5.0
                    score BAYES_999 1.5
                    
                    # scoring HTML
                    score HTML_FONT_LOW_CONTRAST 0.5
                    score HTML_IMAGE_ONLY_04 1.5
                    score HTML_IMAGE_ONLY_08 2.0
                    score HTML_IMAGE_ONLY_12 2.0
                    score HTML_IMAGE_ONLY_16 2.0
                    score HTML_IMAGE_ONLY_20 2.0
                    score HTML_IMAGE_ONLY_24 2.5
                    score HTML_IMAGE_ONLY_28 2.5
                    score HTML_IMAGE_ONLY_32 3.0
                    score HTML_IMAGE_RATIO_02 0.0
                    score HTML_IMAGE_RATIO_04 0.0
                    score HTML_IMAGE_RATIO_06 0.0
                    score HTML_IMAGE_RATIO_08 0.0
                    score HTML_MESSAGE 0.0
                    
                    # scoring HEADER & MISSING
                    score HEADER_FROM_DIFFERENT_DOMAINS 0.5
                    score HEADER_SPAM 2.5
                    score MISSING_DATE 3.0
                    score MISSING_FROM 1.5
                    score MISSING_HB_SEP 0.0
                    score MISSING_HEADERS 1.5
                    score MISSING_MID 1.0
                    score MISSING_MIMEOLE 2.0
                    score MISSING_SUBJECT 2.0
                    
                    # scoring FREEMAIL
                    score FORGED_GMAIL_RCVD 2.5
                    score FORGED_YAHOO_RCVD 2.5
                    score FREEMAIL_ENVFROM_END_DIGIT 0.5
                    score FREEMAIL_FORGED_REPLYTO 0.5
                    score FREEMAIL_FROM 0
                    score FREEMAIL_REPLY 0.5
                    score FREEMAIL_REPLYTO 0.5
                    score FREEMAIL_REPLYTO_END_DIGIT 0.5
                    score MALFORMED_FREEMAIL 4.0
                    
                    # additional scoring tweaks
                    score BILLION_DOLLARS 2.0
                    score BODY_URI_ONLY 1.5
                    score EMPTY_MESSAGE 1.5
                    score HELO_DYNAMIC_SPLIT_IP 2.0
                    score HK_RANDOM_ENVFROM 0.5
                    score HK_RANDOM_FROM 0.5
                    score LOTS_OF_MONEY 0.5
                    score MPART_ALT_DIFF 0.5
                    score MPART_ALT_DIFF_COUNT 1.0
                    score NO_DNS_FOR_FROM 0.5
                    score PDS_TONAME_EQ_TOLOCAL 0.5
                    score PDS_TONAME_EQ_TOLOCAL_VSHORT 0.5
                    score RDNS_NONE 1.5
                    score REPLYTO_WITHOUT_TO_CC 2.5
                    score UNPARSEABLE_RELAY 0.5
                    score URI_DQ_UNSUB 2.0
                    
                    # add GDUB TRUNCATE DNSBL
                    header RCVD_IN_GBUDB eval:check_rbl('gbudb', 'truncate.gbudb.net.')
                    describe RCVD_IN_GBUDB Listed in truncate.gbudb.net
                    tflags RCVD_IN_GBUDB net
                    
                    # add JMF-Black DNSBL
                    header RCVD_IN_JMF_BL eval:check_rbl('jmf', 'black.junkemailfilter.com.')
                    describe RCVD_IN_JMF_BL Listed in black.junkemailfilter.com
                    tflags RCVD_IN_JMF_BL net
                    
                    # add Spamrats DNSBL
                    header RCVD_IN_SPAMRATS eval:check_rbl('spamrats', 'all.spamrats.com.')
                    describe RCVD_IN_SPAMRATS Sender listed in all.spamrats.com
                    tflags RCVD_IN_SPAMRATS net
                    
                    # add SpamEatingMonkey backscatter DNSBL
                    header RCVD_IN_SEM_BACKSCATTER eval:check_rbl('sem', 'backscatter.spameatingmonkey.net')
                    tflags RCVD_IN_SEM_BACKSCATTER net
                    describe RCVD_IN_SEM_BACKSCATTER Received from an IP listed by SEM-BACKSCATTER
                    
                    # add SpamEatingMonkey network blacklist DNSBL
                    header RCVD_IN_SEM_NET_BLACK eval:check_rbl('sem', 'netbl.spameatingmonkey.net')
                    tflags RCVD_IN_SEM_NET_BLACK net
                    describe RCVD_IN_SEM_NET_BLACK Received from an IP listed by SpamEatingMonkeys
                    
                    # add SpamEatingMonkey blacklist DNSBL
                    header RCVD_IN_SEM_BLACK eval:check_rbl('sem', 'bl.spameatingmonkey.net')
                    tflags RCVD_IN_SEM_BLACK net
                    describe RCVD_IN_SEM_BLACK Received from an IP listed by SpamEatingMonkeys
                    
                    # add SpamEatingMonkey URIBL
                    urirhssub URIBL_SEM uribl.spameatingmonkey.net. A 2
                    body URIBL_SEM eval:check_uridnsbl('URIBL_SEM')
                    describe URIBL_SEM Contains a URI listed by SpamEatingMonkeys
                    tflags URIBL_SEM net
                    
                    # add SpamEatingMonkey fresh domain URIBL
                    urirhssub URIBL_SEM_FRESH30 fresh30.spameatingmonkey.net. A 2
                    body URIBL_SEM_FRESH30 eval:check_uridnsbl('URIBL_SEM_FRESH30')
                    describe URIBL_SEM_FRESH30 From a domain registered less than 30 days ago
                    tflags URIBL_SEM_FRESH30 net
                    
                    # add UCE DNSBL
                    header RCVD_IN_UCEPROTECT2 eval:check_rbl_txt('uceprotect2-lastexternal', 'dnsbl-2.uceprotect.net.')
                    describe RCVD_IN_UCEPROTECT2  Listed in dnsbl-2.uceprotect.net (open relay/proxy/dialup)
                    tflags   RCVD_IN_UCEPROTECT2  net
                    

                    Also I have found the Abusix spam filtering to be very effective too with no false-positives that I've found. Something like <UUID>.combined.mail.abusix.zone once you've registered for free (it's a free service for up to 5,000 queries per day).

                    --
                    Dustin Dauncey
                    www.d19.ca

                    necrevistonnezr timconsidine jdaviescoates 3 Replies Last reply Reply Quote 4
                    • necrevistonnezr
                      necrevistonnezr @d19dotca last edited by

                      @d19dotca thanks!

                      I noticed you donโ€™t use the SpamAssassin rules by Abusix mentioned here: https://docs.abusix.com/abusix-mail-intelligence/gbG8EcJ3x3fSUv8cMZLiwA/setting-up-different-systems/dmw9dcwSGSNQiLTssFAnBW#spamassassin โ€ฆ.?

                      Also, as Abusix has its headquarters in the US - is using their services still GDPR compliant? At least in theory, a DSNBL provider might see a lot of metadata from your mails (unless you rsync the list to your server, I believe).

                      d19dotca 1 Reply Last reply Reply Quote 1
                      • d19dotca
                        d19dotca @necrevistonnezr last edited by

                        @necrevistonnezr I'm based in Canada and we don't really have a GDPR, so I can't necessarily say with confidence, however in my understanding... the short answer I believe is "yes, it should be GDPR compliant".

                        Abusix is just hosting an IP table blacklist which Cloudron's SMTP server would use to lookup if an IP is located on their list. Abusix would have no idea about the email contents as it isn't scanning them at all since it wasn't given the email message itself, only the originating IP address of the SMTP server that was used to send from. It's simply a DNSBL, and doesn't act any differently than basically every other DNSBL, the only difference in this case is I chose to use Abusix at the MTA layer instead of the application layer which means it is rejected before it even consumes much resources by Cloudron (before it's technically accepted by the Cloudron SMTP server). The other DNSBL lists I setup in SpamAssassin because they usually are good but not good enough to use at the MTA layer as ideally there should be 0% false-positives in the MTA layer otherwise legitimate email will never arrive.

                        Hopefully that helps clarify it a bit. ๐Ÿ™‚

                        --
                        Dustin Dauncey
                        www.d19.ca

                        necrevistonnezr 1 Reply Last reply Reply Quote 5
                        • necrevistonnezr
                          necrevistonnezr @d19dotca last edited by necrevistonnezr

                          @d19dotca
                          Hi, I looked into the matter a bit yesterday.

                          At least under GDPR, even transmitting IP addresses can be a problem.

                          Under recital 30 of the GDPR, an IP address is and "identifier" and protected as personal data:

                          "Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them." (source: https://gdpr.eu/recital-30-online-identifiers-for-profiling-and-identification/ and https://gdpr.eu/eu-gdpr-personal-data/).

                          Transmitting such data to a US entity without proper agreements and controls in place (which is currently virtually impossible after the Schrems II judgment, see https://www.cms-lawnow.com/ealerts/2022/05/schrems-ii-reactions-to-the-judgement-and-the-supervisory-authorities-recommendations-update-33) is non compliant.

                          Therefore, professional providers (including my employer ๐Ÿ™‚ ) rsync those lists to their local servers and conduct the matching with DNS-blacklists locally.

                          This can be relevant for you if you sell your services as GDPR-compliant...

                          d19dotca 1 Reply Last reply Reply Quote 3
                          • timconsidine
                            timconsidine App Dev @d19dotca last edited by

                            @d19dotca just letting you and others know that after implementing your list, spam on one account has reduced by 70% ๐Ÿ‘ ๐Ÿพ

                            Thank you so much !

                            1 Reply Last reply Reply Quote 4
                            • d19dotca
                              d19dotca @necrevistonnezr last edited by

                              @necrevistonnezr - Ah very interesting! I knew IP addresses were generally considered private data but didn't realize public SMTP server IP addresses were treated the same way in the EU for GDPR. ๐Ÿค” Thanks for the insight, I'll definitely consider that going forward! I don't currently advertise as GDPR-compliant because my customers and I are all located in Canada where the GDPR doesn't exist (and they only offer their services in Canada too currently), but I try to follow the general philosophies / intentions of it such as respecting do-not-track cookies, logging least personal info as possible, able to delete the data upon request, etc. This is good info to have though if that all changes for my customers or my own offerings where I need to then pay more attention to GDPR.

                              @timconsidine - That's great to hear! Makes me happy to know that list is helping people. ๐Ÿ™‚

                              --
                              Dustin Dauncey
                              www.d19.ca

                              necrevistonnezr 1 Reply Last reply Reply Quote 4
                              • necrevistonnezr
                                necrevistonnezr @d19dotca last edited by

                                @d19dotca said in Sharing custom SpamAssassin Rules:

                                @necrevistonnezr - Ah very interesting! I knew IP addresses were generally considered private data but didn't realize public SMTP server IP addresses were treated the same way in the EU for GDPR. ๐Ÿค”

                                Just to be clear (as I have understood): when you do a matching to a DNSBL, you send your SMTP server's IP as well as IPs / domains / patterns that seem suspicious (and hence you want to match with the DNS list) to the list operator - this combination of identifiers can contain quite a bit of information and therefore can be problematic to process.

                                timconsidine 1 Reply Last reply Reply Quote 1
                                • timconsidine
                                  timconsidine App Dev @necrevistonnezr last edited by

                                  @necrevistonnezr I avoid fussing about GDPR as I consider it a total mess but one important distinction to bear in mind is that while an IP address is indeed capable of indicating identity, the core issue is whether it is โ€œPIDโ€ : personally identifiable data.

                                  If the server is in a company name, I would think it questionable whether its IP address is PID.

                                  Equally it is about protecting the privacy of those you have a relationship with, e.g. customers, prospects, suppliers, employees.

                                  If someone is potentially spamming me, I donโ€™t have any relationship with them, and I donโ€™t see any issue with passing their data to anyone else for checking. They may not be a person either, so it may well not be PID.

                                  Generally I think GDPR is โ€œover-appliedโ€ and extended through excess caution, just to avoid any risk of non-compliance. Owing to my generally negative attitude towards GDPR, I err towards a restricted interpretation and a โ€œf*ck โ€˜emโ€ attitude. In the event of a complaint, run them in circles with a response challenging their interpretation of GDPR. They wonโ€™t bothered to prove their case.

                                  Letโ€™s all stop pandering to the legislative cr@p invented by EU bureaucrats who generally knew closeto nothing about the subject when they started their grand project (had to justify their existence and salaries somehow).

                                  humptydumpty necrevistonnezr 2 Replies Last reply Reply Quote 3
                                  • humptydumpty
                                    humptydumpty @timconsidine last edited by humptydumpty

                                    @timconsidine US resident here and just wanted to say that when I first heard about GDPR, I was like "WTF is that" and had the same "f*ck 'em" attitude. However, US privacy laws are dog shit so when I heard the EU fined Google for non-compliance, it made me chuckle. No law will be perfect, abusers will find loopholes, and politicians are.. well, why state the obvious. But if I had to choose between having GDPR or not, I prefer to have some protection laws.

                                    timconsidine 1 Reply Last reply Reply Quote 4
                                    • timconsidine
                                      timconsidine App Dev @humptydumpty last edited by timconsidine

                                      @humptydumpty some privacy laws are definitely good ๐Ÿ‘ and absolutely needed and should be global ๐Ÿ’ช.
                                      But not as structured / implemented in GDPR which is a mess.

                                      For many businesses, itโ€™s actually cheaper just to do โ€œthe right thingโ€, behave professionally with good security and ethics, and then risk a GDPR fine (which is highly unlikely anyway if youโ€™ve done the preceding) than go through the expensive time-consuming nightmare bureaucracy that some suit behind a desk has thought a good idea.

                                      We spent about 1-2 days on the important end-user customer-facing stuff, and about 12 months on the B2B contract ramifications, with everyone trying to shift the blame and responsibility while imposing stingent hand-cuffs.

                                      No issues with privacy legislation itself, but I would point a flame-thrower at GDPR itself.

                                      Think I better shut up now !
                                      Too many people have a vested interest in promoting GDPR (lawyers, consultants, tech vendors etc.)

                                      1 Reply Last reply Reply Quote 1
                                      • necrevistonnezr
                                        necrevistonnezr @timconsidine last edited by necrevistonnezr

                                        @timconsidine said in Sharing custom SpamAssassin Rules:

                                        @necrevistonnezr I avoid fussing about GDPR as I consider it a total mess but one important distinction to bear in mind is that while an IP address is indeed capable of indicating identity, the core issue is whether it is โ€œPIDโ€ : personally identifiable data.

                                        As I said, Identifiers can be problematic in combination. And please think of false positives, where totally legit IPs are combined with your server domain - think a private domain and an IP to abortion information, stuff like that. BTW companies are not protected, only persons.

                                        And while GDPR is exhausting (mostly, if not really understood) and needs improvements, it has lead to many companies thinking privacy when developing a product, not just afterwards. Or how they need to secure private data with technical and organizational measures (Art 32 GDPR) - hardcoding passwords or keeping them unencrypted for example (think the current Twitter scandal) can lead to fines and liability. Itโ€™s a new mind set.

                                        1 Reply Last reply Reply Quote 4
                                        • Referenced by  humptydumpty humptydumpty 
                                        • jdaviescoates
                                          jdaviescoates @d19dotca last edited by

                                          @d19dotca said in Sharing custom SpamAssassin Rules:

                                          @necrevistonnezr Yes, you can simply copy & paste the entire thing.

                                          Even though you link to the docs methinks it's worth explicitly adding this to the top post too, perhaps also with a mention to scroll down to find your latest tweaks) ๐Ÿ™‚ i.e.

                                          Just copy the latest set of rules (scroll down the thread to find the most recent) and then paste them into the Custom Spamassassin Rules box that pops up when you press the little pencil edit icon in Email -> Setting -> Spam filtering:

                                          https://docs.cloudron.io/img/mail-spam-blacklist.png

                                          Thanks again (if you can count my previous upvote as a thanks ๐Ÿ˜† ) for sharing this!

                                          I use Cloudron with Gandi & Hetzner

                                          d19dotca 1 Reply Last reply Reply Quote 1
                                          • d19dotca
                                            d19dotca @jdaviescoates last edited by

                                            @jdaviescoates said in Sharing custom SpamAssassin Rules:

                                            Even though you link to the docs methinks it's worth explicitly adding this to the top post too, perhaps also with a mention to scroll down to find your latest tweaks)

                                            I'd like to do that but unfortunately (I guess too much time has passed so) it won't let me edit the original post anymore. ๐Ÿ˜ž All I can do is post updates to this one. Maybe @girish or somebody with admin privileges can allow me to do that or make the edit for me?

                                            --
                                            Dustin Dauncey
                                            www.d19.ca

                                            1 Reply Last reply Reply Quote 2
                                            • girish
                                              girish Staff last edited by

                                              I have elongated the post editing time frame.

                                              ? 1 Reply Last reply Reply Quote 2
                                              • ?
                                                A Former User @girish last edited by

                                                @girish, But do we get updates when @d19dotca just edits the post?

                                                humptydumpty 1 Reply Last reply Reply Quote 0
                                                • humptydumpty
                                                  humptydumpty @Guest last edited by humptydumpty

                                                  @wirkaholic you should get a notification on the forum but you can make sure you're "watching" this topic as shown below.

                                                  0669247f-3d2f-4414-9d82-3e412a3a6a3e-image.png

                                                  Also, in your account settings, you can have the forum email you when you have notifications. Go to Profile > Settings > Notifications > When a post is edited in a topic you are watching > Set it to " Notification & Email".

                                                  a96164d9-6016-49d9-ae27-666b01474118-image.png

                                                  ? 2 Replies Last reply Reply Quote 1
                                                  • ?
                                                    A Former User @humptydumpty last edited by

                                                    This post is deleted!
                                                    1 Reply Last reply Reply Quote 0
                                                    • ?
                                                      A Former User @humptydumpty last edited by

                                                      @humptydumpty Yes, I can see! Thanks for your prompt reply!

                                                      1 Reply Last reply Reply Quote 0
                                                      • d19dotca
                                                        d19dotca last edited by d19dotca

                                                        Updated SpamAssassin Rules list for anyone wanting to use it or compare against the previous versions. Realized many rules weren't ever triggered and some lists were rarely ever used (GDUBD for example was removed as it only was triggered on 2 emails out of hundreds, so didn't seem worthwhile to keep using).

                                                        Highlights include:

                                                        • Removed a few of the outdated/never used DNSBLs
                                                        • Added in more SpamRATS and JunkEmailFilter HostKarma lists for better control over scoring (specifically added a new HostKarma allowlist too from JunkEmailFilter rather than only using the blocklist)
                                                        • Renamed a few of the SpamRATS and JunkEmailFilter HostKarma rules to reflect the service providers recommended names
                                                        • Small tweaks to various scores
                                                        # scoring BAYES
                                                        score BAYES_00 -5.0
                                                        score BAYES_05 -4.0
                                                        score BAYES_20 0.5
                                                        score BAYES_40 1.5
                                                        score BAYES_50 2.0
                                                        score BAYES_60 2.5
                                                        score BAYES_80 3.0
                                                        score BAYES_95 3.5
                                                        score BAYES_99 4.0
                                                        score BAYES_999 1.0
                                                        
                                                        # scoring DNSBLs & DNSWLs
                                                        score RCVD_IN_BL_SPAMCOP_NET 2.0
                                                        score RCVD_IN_DNSWL_BLOCKED 0.0
                                                        score RCVD_IN_DNSWL_HI -5.0
                                                        score RCVD_IN_DNSWL_LOW -2.0
                                                        score RCVD_IN_DNSWL_MED -3.0
                                                        score RCVD_IN_DNSWL_NONE -0.5
                                                        score RCVD_IN_HOSTKARMA_BL 3.0
                                                        score RCVD_IN_HOSTKARMA_BR 0.5
                                                        score RCVD_IN_HOSTKARMA_W -5.0
                                                        score RCVD_IN_MSPIKE_BL 1.0
                                                        score RCVD_IN_MSPIKE_H2 0.0
                                                        score RCVD_IN_MSPIKE_H3 -0.5
                                                        score RCVD_IN_MSPIKE_H4 -1.0
                                                        score RCVD_IN_MSPIKE_H5 -3.0
                                                        score RCVD_IN_MSPIKE_L2 1.5
                                                        score RCVD_IN_MSPIKE_L3 2.5
                                                        score RCVD_IN_MSPIKE_L4 3.5
                                                        score RCVD_IN_MSPIKE_L5 4.5
                                                        score RCVD_IN_MSPIKE_WL -2.0
                                                        score RCVD_IN_MSPIKE_ZBI 4.0
                                                        score RCVD_IN_PBL 3.5
                                                        score RCVD_IN_SBL 3.5
                                                        score RCVD_IN_SBL_CSS 3.5
                                                        score RCVD_IN_SORBS_BLOCK 2.5
                                                        score RCVD_IN_SORBS_DUL 2.5
                                                        score RCVD_IN_SORBS_HTTP 2.5
                                                        score RCVD_IN_SORBS_MISC 2.5
                                                        score RCVD_IN_SORBS_SMTP 2.5
                                                        score RCVD_IN_SORBS_SOCKS 2.5
                                                        score RCVD_IN_SORBS_SPAM 2.5
                                                        score RCVD_IN_SORBS_WEB 2.5
                                                        score RCVD_IN_SORBS_ZOMBIE 2.5
                                                        score RCVD_IN_SPAMRATS_DYNA 3.0
                                                        score RCVD_IN_SPAMRATS_NOPTR 2.0
                                                        score RCVD_IN_SPAMRATS_SPAM 1.0
                                                        score RCVD_IN_XBL 3.5
                                                        score RCVD_IN_ZEN_BLOCKED 0.0
                                                        score RCVD_IN_ZEN_BLOCKED_OPENDNS 0.0
                                                        
                                                        # scoring URIBLs
                                                        score URIBL_ABUSE_SURBL 4.5
                                                        score URIBL_BLACK 4.5
                                                        score URIBL_CR_SURBL 3.5
                                                        score URIBL_CSS 2.0
                                                        score URIBL_CSS_A 2.0
                                                        score URIBL_DBL_ABUSE_BOTCC 3.5
                                                        score URIBL_DBL_ABUSE_MALW 3.5
                                                        score URIBL_DBL_ABUSE_PHISH 3.5
                                                        score URIBL_DBL_ABUSE_REDIR 1.0
                                                        score URIBL_DBL_ABUSE_SPAM 3.0
                                                        score URIBL_DBL_BLOCKED 0.0
                                                        score URIBL_DBL_BLOCKED_OPENDNS 0.0
                                                        score URIBL_DBL_BOTNETCC 3.0
                                                        score URIBL_DBL_ERROR 0.0
                                                        score URIBL_DBL_MALWARE 3.5
                                                        score URIBL_DBL_PHISH 3.5
                                                        score URIBL_DBL_SPAM 3.5
                                                        score URIBL_GREY 1.0
                                                        score URIBL_MW_SURBL 3.5
                                                        score URIBL_PH_SURBL 3.5
                                                        score URIBL_RED 0.5
                                                        score URIBL_RHS_DOB 2.0
                                                        score URIBL_SBL 1.5
                                                        score URIBL_SBL_A 1.5
                                                        score URIBL_ZEN_BLOCKED 0.0
                                                        score URIBL_ZEN_BLOCKED_OPENDNS 0.0
                                                        
                                                        # scoring DKIM & SPF
                                                        score DKIM_INVALID 1.5
                                                        score DKIM_SIGNED 0.0
                                                        score DKIM_VALID 0.0
                                                        score DKIM_VALID_AU 0.0
                                                        score DKIM_VALID_EF 0.0
                                                        score DKIM_VERIFIED 0.0
                                                        score DKIMWL_BL 3.0
                                                        score DKIMWL_WL_HIGH -3.5
                                                        score DKIMWL_WL_MED -2.5
                                                        score DKIMWL_WL_MEDHI -3.0
                                                        score FORGED_SPF_HELO 3.0
                                                        score SPF_FAIL 1.5
                                                        score SPF_HELO_FAIL 1.5
                                                        score SPF_HELO_NEUTRAL 1.0
                                                        score SPF_HELO_NONE 0.5
                                                        score SPF_HELO_PASS 0.0
                                                        score SPF_HELO_SOFTFAIL 1.5
                                                        score SPF_NEUTRAL 0.5
                                                        score SPF_NONE 0.5
                                                        score SPF_PASS 0.0
                                                        score SPF_SOFTFAIL 1.5
                                                        score USER_IN_DEF_DKIM_WL -5.0
                                                        
                                                        # scoring HTML
                                                        score HTML_FONT_LOW_CONTRAST 0.5
                                                        score HTML_IMAGE_ONLY_04 0.5
                                                        score HTML_IMAGE_ONLY_08 0.5
                                                        score HTML_IMAGE_ONLY_12 1.0
                                                        score HTML_IMAGE_ONLY_16 1.0
                                                        score HTML_IMAGE_ONLY_20 2.0
                                                        score HTML_IMAGE_ONLY_24 2.0
                                                        score HTML_IMAGE_ONLY_28 2.5
                                                        score HTML_IMAGE_ONLY_32 3.0
                                                        score HTML_IMAGE_RATIO_02 0.0
                                                        score HTML_IMAGE_RATIO_04 0.0
                                                        score HTML_IMAGE_RATIO_06 0.0
                                                        score HTML_IMAGE_RATIO_08 0.0
                                                        score HTML_MESSAGE 0.0
                                                        
                                                        # scoring HEADER & MISSING
                                                        score HEADER_FROM_DIFFERENT_DOMAINS 0.5
                                                        score HEADER_SPAM 2.5
                                                        score MISSING_DATE 3.0
                                                        score MISSING_FROM 1.5
                                                        score MISSING_HB_SEP 0.0
                                                        score MISSING_HEADERS 1.5
                                                        score MISSING_MID 1.0
                                                        score MISSING_MIMEOLE 1.0
                                                        score MISSING_SUBJECT 1.0
                                                        
                                                        # scoring FREEMAIL
                                                        score FORGED_GMAIL_RCVD 1.5
                                                        score FORGED_YAHOO_RCVD 1.5
                                                        score FREEMAIL_ENVFROM_END_DIGIT 0.5
                                                        score FREEMAIL_FORGED_REPLYTO 0.5
                                                        score FREEMAIL_FROM 0
                                                        score FREEMAIL_REPLY 0.5
                                                        score FREEMAIL_REPLYTO 0.5
                                                        score FREEMAIL_REPLYTO_END_DIGIT 0.5
                                                        score MALFORMED_FREEMAIL 4.0
                                                        
                                                        # additional scoring tweaks
                                                        score BILLION_DOLLARS 2.0
                                                        score BODY_URI_ONLY 1.5
                                                        score EMPTY_MESSAGE 1.5
                                                        score HELO_DYNAMIC_SPLIT_IP 2.0
                                                        score HK_RANDOM_ENVFROM 0.5
                                                        score HK_RANDOM_FROM 0.5
                                                        score LOTS_OF_MONEY 0.5
                                                        score MPART_ALT_DIFF 0.5
                                                        score MPART_ALT_DIFF_COUNT 1.0
                                                        score NO_DNS_FOR_FROM 0.5
                                                        score PDS_TONAME_EQ_TOLOCAL 0.5
                                                        score PDS_TONAME_EQ_TOLOCAL_VSHORT 0.5
                                                        score RDNS_NONE 1.5
                                                        score REPLYTO_WITHOUT_TO_CC 2.5
                                                        score UNPARSEABLE_RELAY 0.5
                                                        score URI_DQ_UNSUB 2.0
                                                        score T_FILL_THIS_FORM_SHORT 0.5
                                                        
                                                        # add JunkEmailFilter HostKarma DNSBL & DNSWL
                                                        header __RCVD_IN_HOSTKARMA eval:check_rbl('HOSTKARMA-lastexternal','hostkarma.junkemailfilter.com.')
                                                        describe __RCVD_IN_HOSTKARMA Sender listed in JunkEmailFilter
                                                        tflags __RCVD_IN_HOSTKARMA net
                                                        header RCVD_IN_HOSTKARMA_W eval:check_rbl_sub('HOSTKARMA-lastexternal','127.0.0.1')
                                                        describe RCVD_IN_HOSTKARMA_W Sender listed in HOSTKARMA-WHITE
                                                        tflags RCVD_IN_HOSTKARMA_W net nice
                                                        header RCVD_IN_HOSTKARMA_BL eval:check_rbl_sub('HOSTKARMA-lastexternal','127.0.0.2')
                                                        describe RCVD_IN_HOSTKARMA_BL Sender listed in HOSTKARMA-BLACK
                                                        tflags RCVD_IN_HOSTKARMA_BL net
                                                        header RCVD_IN_HOSTKARMA_BR eval:check_rbl_sub('HOSTKARMA-lastexternal','127.0.0.4')
                                                        describe RCVD_IN_HOSTKARMA_BR Sender listed in HOSTKARMA-BROWN
                                                        tflags RCVD_IN_HOSTKARMA_BR net
                                                        
                                                        # add Spamrats DNSBL
                                                        header __RCVD_IN_SPAMRATS eval:check_rbl('spamrats-lastexternal','all.spamrats.com.')
                                                        describe __RCVD_IN_SPAMRATS SPAMRATS: sender is listed in SpamRats
                                                        tflags __RCVD_IN_SPAMRATS net
                                                        reuse __RCVD_IN_SPAMRATS
                                                        header RCVD_IN_SPAMRATS_DYNA eval:check_rbl_sub('spamrats-lastexternal','127.0.0.36')
                                                        describe RCVD_IN_SPAMRATS_DYNA RATS-Dyna: sent directly from dynamic IP address
                                                        tflags RCVD_IN_SPAMRATS_DYNA net
                                                        reuse RCVD_IN_SPAMRATS_DYNA
                                                        header RCVD_IN_SPAMRATS_NOPTR eval:check_rbl_sub('spamrats-lastexternal','127.0.0.37')
                                                        describe RCVD_IN_SPAMRATS_NOPTR RATS-NoPtr: sender has no reverse DNS
                                                        tflags RCVD_IN_SPAMRATS_NOPTR net
                                                        reuse RCVD_IN_SPAMRATS_NOPTR
                                                        header RCVD_IN_SPAMRATS_SPAM eval:check_rbl_sub('spamrats-lastexternal','127.0.0.38')
                                                        describe RCVD_IN_SPAMRATS_SPAM RATS-Spam: sender is a spam source
                                                        tflags RCVD_IN_SPAMRATS_SPAM net
                                                        reuse RCVD_IN_SPAMRATS_SPAM
                                                        

                                                        --
                                                        Dustin Dauncey
                                                        www.d19.ca

                                                        doodlemania2 1 Reply Last reply Reply Quote 5
                                                        • doodlemania2
                                                          doodlemania2 App Dev @d19dotca last edited by

                                                          @d19dotca This is cool! How do I "implement" it?

                                                          d19dotca 1 Reply Last reply Reply Quote 1
                                                          • d19dotca
                                                            d19dotca @doodlemania2 last edited by

                                                            @doodlemania2 You simply add it to the Cloudron Email function under Spam Filtering > Custom SpamAssassin Rules. It's documented here: https://docs.cloudron.io/email/#custom-spam-filtering-rules ๐Ÿ™‚

                                                            --
                                                            Dustin Dauncey
                                                            www.d19.ca

                                                            1 Reply Last reply Reply Quote 2
                                                            • d19dotca
                                                              d19dotca last edited by d19dotca

                                                              While I noticed some improvements in my last set of rules I also saw a few extras getting through to my inbox too, so I think the last update was a "one step forward, two steps back" update, so I apologize if anyone saw a decrease in effectiveness if using the latest list. I immediately made some tweaks and have noticed this seems to be more effective. Let me know if you have any issues though. ๐Ÿ™‚

                                                              # scoring BAYES
                                                              score BAYES_00 -5.0
                                                              score BAYES_05 -4.0
                                                              score BAYES_20 1.0
                                                              score BAYES_40 2.0
                                                              score BAYES_50 2.5
                                                              score BAYES_60 3.0
                                                              score BAYES_80 3.5
                                                              score BAYES_95 4.0
                                                              score BAYES_99 4.5
                                                              score BAYES_999 1.0
                                                              
                                                              # scoring DNSBLs & DNSWLs
                                                              score RCVD_IN_BL_SPAMCOP_NET 2.0
                                                              score RCVD_IN_DNSWL_BLOCKED 0
                                                              score RCVD_IN_DNSWL_HI -6.0
                                                              score RCVD_IN_DNSWL_LOW -2.0
                                                              score RCVD_IN_DNSWL_MED -4.0
                                                              score RCVD_IN_DNSWL_NONE 0.5
                                                              score RCVD_IN_HOSTKARMA_BL 2.0
                                                              score RCVD_IN_HOSTKARMA_BR 0.5
                                                              score RCVD_IN_HOSTKARMA_W -5.0
                                                              score RCVD_IN_MSPIKE_BL 0.0
                                                              score RCVD_IN_MSPIKE_H2 -0.5
                                                              score RCVD_IN_MSPIKE_H3 -0.5
                                                              score RCVD_IN_MSPIKE_H4 -2.0
                                                              score RCVD_IN_MSPIKE_H5 -3.0
                                                              score RCVD_IN_MSPIKE_L3 0.5
                                                              score RCVD_IN_MSPIKE_L4 2.0
                                                              score RCVD_IN_MSPIKE_L5 3.0
                                                              score RCVD_IN_MSPIKE_WL 0.0
                                                              score RCVD_IN_MSPIKE_ZBI 2.0
                                                              score RCVD_IN_PBL 3.0
                                                              score RCVD_IN_SBL 3.0
                                                              score RCVD_IN_SBL_CSS 3.0
                                                              score RCVD_IN_SPAMRATS_DYNA 2.0
                                                              score RCVD_IN_SPAMRATS_NOPTR 2.0
                                                              score RCVD_IN_SPAMRATS_SPAM 3.0
                                                              score RCVD_IN_XBL 3.0
                                                              score RCVD_IN_ZEN_BLOCKED 0.0
                                                              score RCVD_IN_ZEN_BLOCKED_OPENDNS 0.0
                                                              
                                                              # scoring URIBLs
                                                              score URIBL_ABUSE_SURBL 4.5
                                                              score URIBL_BLACK 4.5
                                                              score URIBL_CR_SURBL 3.5
                                                              score URIBL_CSS 2.0
                                                              score URIBL_CSS_A 2.0
                                                              score URIBL_DBL_ABUSE_BOTCC 3.0
                                                              score URIBL_DBL_ABUSE_MALW 3.0
                                                              score URIBL_DBL_ABUSE_PHISH 3.0
                                                              score URIBL_DBL_ABUSE_REDIR 1.0
                                                              score URIBL_DBL_ABUSE_SPAM 3.0
                                                              score URIBL_DBL_BLOCKED 0.0
                                                              score URIBL_DBL_BLOCKED_OPENDNS 0.0
                                                              score URIBL_DBL_BOTNETCC 3.0
                                                              score URIBL_DBL_ERROR 0.0
                                                              score URIBL_DBL_MALWARE 3.0
                                                              score URIBL_DBL_PHISH 3.0
                                                              score URIBL_DBL_SPAM 3.0
                                                              score URIBL_GREY 1.0
                                                              score URIBL_MW_SURBL 3.5
                                                              score URIBL_PH_SURBL 3.5
                                                              score URIBL_RED 0.5
                                                              score URIBL_RHS_DOB 2.0
                                                              score URIBL_SBL 3.0
                                                              score URIBL_SBL_A 3.0
                                                              score URIBL_ZEN_BLOCKED 0.0
                                                              score URIBL_ZEN_BLOCKED_OPENDNS 0.0
                                                              
                                                              # scoring DKIM & SPF
                                                              score DKIM_INVALID 1.5
                                                              score DKIM_SIGNED 0.0
                                                              score DKIM_VALID 0.0
                                                              score DKIM_VALID_AU 0.0
                                                              score DKIM_VALID_EF 0.0
                                                              score DKIM_VERIFIED 0.0
                                                              score DKIMWL_BL 3.0
                                                              score DKIMWL_WL_HIGH -3.5
                                                              score DKIMWL_WL_MED -2.5
                                                              score DKIMWL_WL_MEDHI -3.0
                                                              score FORGED_SPF_HELO 3.0
                                                              score SPF_FAIL 1.5
                                                              score SPF_HELO_FAIL 1.5
                                                              score SPF_HELO_NEUTRAL 1.0
                                                              score SPF_HELO_NONE 0.5
                                                              score SPF_HELO_PASS 0.0
                                                              score SPF_HELO_SOFTFAIL 1.5
                                                              score SPF_NEUTRAL 0.5
                                                              score SPF_NONE 0.5
                                                              score SPF_PASS 0.0
                                                              score SPF_SOFTFAIL 1.5
                                                              score USER_IN_DEF_DKIM_WL -5.0
                                                              
                                                              # scoring HTML
                                                              score HTML_FONT_LOW_CONTRAST 0.5
                                                              score HTML_IMAGE_ONLY_04 1.0
                                                              score HTML_IMAGE_ONLY_08 1.0
                                                              score HTML_IMAGE_ONLY_12 1.0
                                                              score HTML_IMAGE_ONLY_16 1.5
                                                              score HTML_IMAGE_ONLY_20 1.5
                                                              score HTML_IMAGE_ONLY_24 2.0
                                                              score HTML_IMAGE_ONLY_28 2.5
                                                              score HTML_IMAGE_ONLY_32 3.0
                                                              score HTML_IMAGE_RATIO_02 0.0
                                                              score HTML_IMAGE_RATIO_04 0.0
                                                              score HTML_IMAGE_RATIO_06 0.0
                                                              score HTML_IMAGE_RATIO_08 0.0
                                                              score HTML_MESSAGE 0.0
                                                              score HTML_MIME_NO_HTML_TAG 0.5
                                                              score HTML_SHORT_LINK_IMG_1 2.5
                                                              score HTML_SHORT_LINK_IMG_2 1.5
                                                              score HTML_SHORT_LINK_IMG_3 0.5
                                                              
                                                              # scoring HEADER & MISSING
                                                              score HEADER_FROM_DIFFERENT_DOMAINS 0.5
                                                              score MISSING_DATE 3.0
                                                              score MISSING_FROM 1.5
                                                              score MISSING_HEADERS 2.0
                                                              score MISSING_SUBJECT 1.0
                                                              
                                                              # scoring FREEMAIL
                                                              score FREEMAIL_ENVFROM_END_DIGIT 0.5
                                                              score FREEMAIL_FORGED_REPLYTO 1.0
                                                              score FREEMAIL_FROM 0
                                                              score FREEMAIL_REPLY 0.5
                                                              score FREEMAIL_REPLYTO 0.5
                                                              score FREEMAIL_REPLYTO_END_DIGIT 0.5
                                                              
                                                              # additional scoring tweaks
                                                              score HELO_DYNAMIC_SPLIT_IP 3.0
                                                              score LOTS_OF_MONEY 0.5
                                                              score MPART_ALT_DIFF 0.5
                                                              score MPART_ALT_DIFF_COUNT 0.5
                                                              score RDNS_NONE 0.5
                                                              score T_FILL_THIS_FORM_SHORT 0.5
                                                              score UNPARSEABLE_RELAY 0.5
                                                              
                                                              # add JunkEmailFilter HostKarma DNSBL & DNSWL
                                                              header __RCVD_IN_HOSTKARMA eval:check_rbl('HOSTKARMA-lastexternal','hostkarma.junkemailfilter.com.')
                                                              describe __RCVD_IN_HOSTKARMA Sender listed in JunkEmailFilter
                                                              tflags __RCVD_IN_HOSTKARMA net
                                                              header RCVD_IN_HOSTKARMA_W eval:check_rbl_sub('HOSTKARMA-lastexternal','127.0.0.1')
                                                              describe RCVD_IN_HOSTKARMA_W Sender listed in HOSTKARMA-WHITE
                                                              tflags RCVD_IN_HOSTKARMA_W net nice
                                                              header RCVD_IN_HOSTKARMA_BL eval:check_rbl_sub('HOSTKARMA-lastexternal','127.0.0.2')
                                                              describe RCVD_IN_HOSTKARMA_BL Sender listed in HOSTKARMA-BLACK
                                                              tflags RCVD_IN_HOSTKARMA_BL net
                                                              header RCVD_IN_HOSTKARMA_BR eval:check_rbl_sub('HOSTKARMA-lastexternal','127.0.0.4')
                                                              describe RCVD_IN_HOSTKARMA_BR Sender listed in HOSTKARMA-BROWN
                                                              tflags RCVD_IN_HOSTKARMA_BR net
                                                              
                                                              # add Spamrats DNSBL
                                                              header __RCVD_IN_SPAMRATS eval:check_rbl('spamrats-lastexternal','all.spamrats.com.')
                                                              describe __RCVD_IN_SPAMRATS SPAMRATS: sender is listed in SpamRats
                                                              tflags __RCVD_IN_SPAMRATS net
                                                              reuse __RCVD_IN_SPAMRATS
                                                              header RCVD_IN_SPAMRATS_DYNA eval:check_rbl_sub('spamrats-lastexternal','127.0.0.36')
                                                              describe RCVD_IN_SPAMRATS_DYNA RATS-Dyna: sent directly from dynamic IP address
                                                              tflags RCVD_IN_SPAMRATS_DYNA net
                                                              reuse RCVD_IN_SPAMRATS_DYNA
                                                              header RCVD_IN_SPAMRATS_NOPTR eval:check_rbl_sub('spamrats-lastexternal','127.0.0.37')
                                                              describe RCVD_IN_SPAMRATS_NOPTR RATS-NoPtr: sender has no reverse DNS
                                                              tflags RCVD_IN_SPAMRATS_NOPTR net
                                                              reuse RCVD_IN_SPAMRATS_NOPTR
                                                              header RCVD_IN_SPAMRATS_SPAM eval:check_rbl_sub('spamrats-lastexternal','127.0.0.38')
                                                              describe RCVD_IN_SPAMRATS_SPAM RATS-Spam: sender is a spam source
                                                              tflags RCVD_IN_SPAMRATS_SPAM net
                                                              reuse RCVD_IN_SPAMRATS_SPAM
                                                              

                                                              --
                                                              Dustin Dauncey
                                                              www.d19.ca

                                                              murgero 1 Reply Last reply Reply Quote 5
                                                              • murgero
                                                                murgero App Dev @d19dotca last edited by

                                                                @d19dotca This looks pretty good. I am testing it now ๐Ÿ™‚

                                                                --
                                                                https://urgero.org
                                                                ~ Professional Nerd. Freelance Programmer. ~
                                                                Matrix: @murgero:urgero.org

                                                                1 Reply Last reply Reply Quote 0
                                                                • First post
                                                                  Last post
                                                                Powered by NodeBB