37 lines
1021 B
Plaintext
37 lines
1021 B
Plaintext
MX_IMPLICIT {
|
|
expression = "MX_GOOD & MX_MISSING";
|
|
score = -0.01;
|
|
}
|
|
VIRUS_FOUND {
|
|
expression = "CLAM_VIRUS & !MAILCOW_WHITE";
|
|
score = 2000;
|
|
}
|
|
SPF_FAIL_NO_DKIM {
|
|
expression = "R_SPF_FAIL & R_DKIM_NA & !MAILCOW_WHITE & !ARC_ALLOW";
|
|
score = 10;
|
|
}
|
|
SOGO_CONTACT_EXCLUDE_FWD_HOST {
|
|
expression = "-WHITELISTED_FWD_HOST & ~SOGO_CONTACT";
|
|
}
|
|
SOGO_CONTACT_SPOOFED {
|
|
expression = "(R_SPF_PERMFAIL | R_SPF_SOFTFAIL | R_SPF_FAIL) & ~SOGO_CONTACT";
|
|
}
|
|
SPOOFED_UNAUTH {
|
|
expression = "!MAILCOW_AUTH & !MAILCOW_WHITE & !R_SPF_ALLOW & !DMARC_POLICY_ALLOW & !ARC_ALLOW & !SIEVE_HOST & MAILCOW_DOMAIN_HEADER_FROM";
|
|
score = 5.0;
|
|
}
|
|
# Only apply to inbound unauthed and not whitelisted
|
|
OLEFY_MACRO {
|
|
expression = "!MAILCOW_AUTH & !MAILCOW_WHITE & OLETOOLS";
|
|
score = 20.0;
|
|
policy = "remove_weight";
|
|
}
|
|
BAD_WORD_BAD_TLD {
|
|
expression = "FISHY_TLD & ( BAD_WORDS | BAD_WORDS_DE )"
|
|
score = 10.0;
|
|
}
|
|
FORGED_W_BAD_POLICY {
|
|
expression = "( ~g+:policies | ~R_SPF_NA) & ( ~FROM_NEQ_ENVFROM & ~FORGED_SENDER )"
|
|
score = 3.0;
|
|
}
|